Senior Detection & Response Analyst

Toyota Tsusho Systems; Plano (TX); On-site; USD 110,000 - 160,000; Full time

Job summary

Toyota Tsusho Systems US is seeking a Senior Detection and Response Analyst to provide ongoing support to the Regional Security Operations program. The role requires maintaining 24x7 monitoring and detection services for internal and external clients, with leadership responsibilities during shifts and a focus on incident containment and remediation.

The ideal candidate has 4+ years in security operations, strong knowledge of networks and cyber threats, and experience with tools like Splunk and

Qualifications

• 4+ years of experience in Security Operations monitoring.
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (preferred).
• Experience with security tools such as Splunk, ATP, Symantec Endpoint, Trend Micro, and firewall solutions.
• Strong knowledge of network monitoring, protocols (DNS/HTTP/SMB), and attack vectors.

Responsibilities

• Act as escalation point for security incidents and provide expert feedback on monitoring improvements.
• Lead shifts as needed, guiding ID team members and prioritizing threats.
• Triage incidents using Threat Intelligence, IDS, firewalls, and boundary protection devices.
• Maintain 24x7 RSOC coverage and participate in on-call rotations.
• Train and mentor Incident Detection Team members; improve day-to-day operations.

Skills

Security monitoring

Incident response

Threat hunting

Communication

Analytical thinking

Network knowledge

Education

Bachelor’s degree in Cybersecurity/IT/CS

Tools

Splunk

Sentinel

Active Directory

Checkpoint Firewalls

TrendMicro Antivirus

McAfee Web Gateway

Blue Coat

Sourcefire

Job description

About TTS-US:

Founded in 2011, Toyota Tsusho Systems US, Inc. (TTS-US) is a Toyota group company, that develops IT solutions wherever global businesses operate. Transforming into a technology and mobility company, TTS-US with its 8 TTS affiliates worldwide is establishing a secure and resilient Toyota global value chain. The creative capacity to forge such limitless business opportunities is one of the strengths of Toyota Tsusho Systems.

Summary:

The Senior Detection and Response Analyst role will provide ongoing support to the Regional Security Operations program. In this role the Senior Detection and Response Analyst is expected to maintain effective 24x7 monitoring and detection services to internal and external clients.

Essential Functions:

• Act as the point of escalation for all security incidents; provide expert level feedback regarding current monitoring and ways to improve it.
• Assume the role of shift lead as needed, and fulfil this responsibility through leadership and guidance of ID team members, proactively prioritizing, identifying, analyzing and remediating threats
• Ensure that the ID Analysts’ daily work activity is completed to the required quality levels and timelines, by verifying that their responsibilities are executed, in accordance with the expectations set by the ID Team Lead
• Triage security incidents and perform in-depth analysis using Cyber Threat Intelligence, intrusion detection systems, firewalls and other boundary protection devices
• Maintain an understanding of the overall threat landscape (cyber, malware, botnets, phishing, DDoS, physical)
• Provide 24x7 coverage to support the RSOC services; Participate in an on‑call rotation
• Support Agentic SOC development through providing expert level feedback, tuning, and feature requests for our engineering team to support accurate machine speed response
• Train and mentor team members within the Incident Detection Team
• Improve the effectiveness and efficiency of day‑to‑day operations
• Assist with service requests from customers and internal teams
• Assist with containment and remediation of threats during incidents. Use an internal ticketing system to track investigated incidents and capture relevant details
• Support Incident Response efforts as needed, including providing counsel, working with the IR team, as well as other involved stakeholders within the organization and customers to drive forward remediation activities
• Conduct threat hunting activities based on internal and external threat intelligence
• Provide expert level feedback regarding current monitoring and ways to improve it
• Create and update daily and monthly reports
• Contribute to the creation of documentation to standardize processes and procedures, including playbooks to improve internal processes and procedures
• Use investigation findings to identify gaps and recommend security posture improvements
• Identify, recommend, coordinate, and deliver timely knowledge to support teams

Competencies:

• Excellent critical thinking, logic, and solution orientation and to learn and adapt quickly
• Ability to learn and operate in a dynamic environment
• Detail-oriented and analytical skills; problem‑solving skills
• Strong verbal and written communication skills
• 4+ years of experience in Security Operations monitoring
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field (preferred)
• Experience with Security Operations processes, procedures, and services
• Experience working with cyber security tools and software such as Sentinel, Splunk, ATP, Symantec Endpoint, TrendMicro Antivirus, McAfee Web Gateway, Checkpoint Firewalls, Bluecoat, Sourcefire, Active Directory, or relevant cyber security assets
• Advanced knowledge of network monitoring and network exploitation techniques
• Strong technical background in security, network, infrastructure, cloud, applications
• Knowledge of risk assessment tools, technologies and methods
• Experience with common attack vectors, including advanced adversaries (nation state/financial motivation)
• Knowledge around common web application attacks including SQL injection, cross‑site scripting, invalid inputs, and forceful browsing
• Knowledge of how common protocols and applications work at the network level, including DNS, HTTP, and SMB
• Experience working with cyber security tools and software such as Splunk, ATP, Symantec Endpoint, TrendMicro Antivirus, McAfee Web Gateway, Checkpoint Firewalls, Bluecoat, Sourcefire, Active Directory, or relevant cyber security assets
• Technical certifications such as GCIA, GCFA, GCIH or CASP is a plus
• Tines (or other automation) experience is highly valued
• Proficient with Microsoft Office & documentation skills (Word, Excel, PowerPoint)