Security Operations Associate

JPMorgan Chase & Co.; Seattle (WA); On-site; USD 90,000 - 125,000; Full time

Job summary

JPMorgan Chase & Co. in Seattle is seeking a Security Operations Associate to protect the firm’s systems and data.

You will work hands-on with modern detection and response capabilities, partnering with technologists across the firm to reduce risk and improve resilience. You will investigate threats, vulnerabilities, and security incidents, use SIEM tooling, and contribute to incident response and playbooks.

Qualifications

• Formal training or certification in security operations with 2+ years of experience.
• Ability to analyze security events using logs from endpoints, networks, and cloud services.
• Scripting knowledge to automate security tasks (Python/PowerShell).
• Understanding of authentication, authorization, identity controls, and cryptographic concepts.
• Experience with SIEM platforms, IDS, EDR, and malware analysis tools.
• Familiarity with the MITRE ATT&CK framework and applying it to investigations.
• Strong investigative mindset with evidence validation and attention to detail.
• Excellent written communication with clear findings and recommendations.

Responsibilities

• Conduct security investigations including log review and root-cause analysis.
• Perform threat hunting across endpoints, networks, and cloud environments.
• Assess vulnerability impact and recommend mitigations.
• Use SIEM and detection tooling to improve alerts and response time.
• Analyze malware, emails, and artifacts to determine intent and containment.
• Collaborate with cross-functional teams to implement security processes and SOPs.
• Contribute to incident response activities including containment and recovery.
• Improve detection content and runbooks to strengthen security posture.

Skills

Threat detection

Investigation & analysis

Scripting (Python/PowerShell)

Communication

Incident response

Threat hunting

Cross-team collaboration

Education

Security operations certification/training

Tools

SIEM platforms

Endpoint/Network security tools

Malware analysis utilities

Cloud security tools

Job description

Join a team that helps protect the systems and data that power a global financial institution. You will work hands-on with modern detection and response capabilities, partnering with technologists across the firm to reduce risk and improve resilience. This role offers meaningful exposure to evolving threat activity, investigative work, and continuous improvement of operational security practices.

As a Security Operations Associate at JPMorganChase within the Detection and Response Operations team, you contribute to safeguarding digital assets by proactively detecting, assessing, and responding to threats, vulnerabilities, and security incidents. You use sound judgment to investigate and resolve cybersecurity issues while improving existing processes and response playbooks. You collaborate across teams to drive coordinated security practices and help raise security awareness through clear guidance and documentation.

Job responsibilities

• Conduct security investigations, including log review, triage, and root-cause analysis of suspicious activity
• Perform threat hunting to identify adversary behaviors across endpoints, networks, and cloud environments
• Assess vulnerability impact by validating exposure, mapping to affected assets, and recommending mitigation actions
• Use Security Information and Event Management (SIEM) and detection tooling to improve alert fidelity and response time
• Analyze malware and suspicious files, emails, and artifacts to determine intent, scope, and containment actions
• Partner with cross-functional teams to implement coordinated security processes, standards, and operating procedures
• Contribute to incident response activities, including containment, eradication, recovery support, and post-incident review
• Propose and implement improvements to detection content, runbooks, and response playbooks to strengthen security posture

Required qualifications, capabilities and skills

• Formal training or certification on security operations concepts and 2+ years applied experience
• Demonstrated ability to analyze security events using logs from endpoints, network devices, and cloud services
• Working knowledge of scripting used to automate security tasks (for example, Python, PowerShell, or similar)
• Strong understanding of authentication, authorization, identity controls, and cryptographic concepts
• Experience using security tools such as SIEM platforms, intrusion detection, endpoint detection, and malware analysis utilities
• Familiarity with the MITRE ATT&CK framework and applying it to investigations and threat hunting
• Proven investigative mindset, including hypothesis-driven analysis, evidence validation, and attention to detail
• Strong written communication skills, including clear documentation of findings, actions taken, and recommendations

Preferred qualifications, capabilities and skills

• Experience supporting security operations in a financial services environment
• One or more cybersecurity certifications (for example, Security+, GCIH, GCIA, or comparable credentials)
• Prior experience in a Security Operations Center or in a dedicated detection and response role
• Experience improving detection logic and operational workflows (for example, tuning alerts, creating playbooks, or automation)

#CTC