Senior Security Analyst

Cybersecurity Jobs; Denver (CO); Hybrid; USD 110,000 - 120,000; Full time

Benefits offered by this job

Health benefits

Volunteer time

Tuition reimbursement

Parental leave

Wellbeing programs

Employee events

Bonus opportunities

Job summary

Cybersecurity Jobs is seeking a Senior Security Analyst to support the Division of the Office of the CISO in Denver. The role focuses on cyber incident response, vulnerability management, and SOC operations across apps, infrastructure, and cloud.

Responsibilities include incident triage, IAM reviews, vulnerability remediation coordination, and ongoing process improvements to align with MITRE ATT&CK, OWASP Top 10, and NIST.

Qualifications

• 2+ years in an Information Security role with proven experience in Security Operations or Threat Analysis.
• Hands-on experience with SIEM and EDR platforms.
• Analytical mindset with knowledge of TTPs, malware behaviour, and incident handling methodologies.
• Familiarity with IAM concepts and monitoring, including reviewing permissions, detecting abuse, and flagging suspicious behaviour or policy violations.
• Experience performing alert triage and incident escalation within defined SLAs, using ITSM tooling such as ServiceNow and Confluence.
• Strong collaboration skills working with application and infrastructure teams in a security context.
• In-depth knowledge of security best practices and frameworks (MITRE ATT&CK, OWASP Top 10, NIST).
• Excellent written and verbal communication skills, including the ability to produce work notes, handover reports, and stakeholder updates.
• Ability to manage multiple projects and tasks.
• Ability to capture and summarise information, solve tactical and strategic problems, and prioritize work.
• Exposure to public cloud infrastructure (SaaS, IaaS, and PaaS).

Responsibilities

• Perform alert triage for security alerts to validate, prioritize, and determine which incidents require follow-up.
• Assess incident severity, impact, and root cause using MSSP capabilities and internal tools.
• Monitor and respond to security alerts and events from tools including SIEM, IDS/IPS, firewalls, email, and EDR, meeting defined SLAs.
• Conduct initial incident triage and assessment to confirm severity and impact.
• Carry out routine reviews of IAM to identify and address abuse of permissions by authorised users.
• Monitor for policy violations and report suspicious user behaviour.
• Assist with containment activities, including isolating affected systems under supervision.
• Maintain work notes and artifact logging in ITSM systems (ServiceNow / Confluence) for incident tickets.
• Complete shift handovers to other SOC team members to support continuity of ongoing incidents, including providing clear updates and escalation details.
• Seek guidance from, and elevate as needed to, Mid-level Tier 2 analysts.
• Support daily security operations by running regular vulnerability scans, analyzing reports, and triaging identified issues for timely risk mitigation.
• Lead end-to-end vulnerability remediation coordination across applications, infrastructure, and cloud environments, working closely with development and operations teams to implement sustainable security controls.
• Optimize vulnerability scanning profiles, dashboards, and reports to improve coverage, actionable insights, and remediation guidance.
• Contribute to continuous improvement of vulnerability management processes, policies, and procedures, including support for incident response activities and alignment with industry best practices.
• Stay current on evolving cyber security threats, vulnerabilities, and attack techniques.
• Participate in on-call rotations and provide triage and escalation support.
• Handle security inbox queries and ensure timely responses to security-related inquiries.
• Perform other duties as assigned.

Skills

Security Operations

Threat Analysis

SIEM

EDR

IAM

ITSM tooling

Team collaboration

MITRE ATT&CK

OWASP Top 10

NIST

Tools

Python

PowerShell

KQL

SOAR

OpenCTI

Recorded Future

MISP

ServiceNow

Confluence

CI/CD

Job description

The Senior Security Analyst role supports the Division of the Office of the CISO, with a focus on cyber incident response and vulnerability management. The position operates within a security operations environment, handling SOC alert triage, incident assessment, vulnerability scanning triage, and coordination of remediation activities across applications, infrastructure, and cloud.

Key Responsibilities

• Perform alert triage for security alerts to validate, prioritize, and determine which incidents require follow-up.
• Assess incident severity, impact, and root cause using MSSP capabilities and internal tools.
• Monitor and respond to security alerts and events from tools including SIEM, IDS/IPS, firewalls, email, and endpoint detection and response (EDR), meeting defined SLAs.
• Conduct initial incident triage and assessment to confirm severity and impact.
• Carry out routine reviews of IAM to identify and address abuse of permissions by authorised users.
• Monitor for policy violations and report suspicious user behaviour.
• Assist with containment activities, including isolating affected systems under supervision.
• Maintain work notes and artifact logging in ITSM systems (ServiceNow / Confluence) for incident tickets.
• Complete shift handovers to other SOC team members to support continuity of ongoing incidents, including providing clear updates and escalation details.
• Seek guidance from, and elevate as needed to, Mid-level Tier 2 analysts.
• Support daily security operations by running regular vulnerability scans, analyzing reports, and triaging identified issues for timely risk mitigation.
• Lead end-to-end vulnerability remediation coordination across applications, infrastructure, and cloud environments, working closely with development and operations teams to implement sustainable security controls.
• Optimize vulnerability scanning profiles, dashboards, and reports to improve coverage, actionable insights, and remediation guidance.
• Contribute to continuous improvement of vulnerability management processes, policies, and procedures, including support for incident response activities and alignment with industry best practices.
• Stay current on evolving cyber security threats, vulnerabilities, and attack techniques.
• Participate in on-call rotations and provide triage and escalation support.
• Handle security inbox queries and ensure timely responses to security-related inquiries.
• Perform other duties as assigned.

Requirements

• 2+ years in an Information Security role with proven experience in Security Operations or Threat Analysis.
• Hands-on experience with SIEM and EDR platforms.
• Analytical mindset with knowledge of TTPs, malware behaviour, and incident handling methodologies.
• Familiarity with IAM concepts and monitoring, including reviewing permissions, detecting abuse, and flagging suspicious behaviour or policy violations.
• Experience performing alert triage and incident escalation within defined SLAs, using ITSM tooling such as ServiceNow and documentation platforms such as Confluence.
• Strong collaboration skills working with application and infrastructure teams in a security context.
• In-depth knowledge of security best practices and frameworks (for example MITRE ATT&CK, OWASP Top 10, NIST).
• Excellent written and verbal communication skills, including the ability to produce work notes, handover reports, and stakeholder updates.
• Ability to manage multiple projects and tasks.
• Ability to capture and summarise information, solve tactical and strategic problems, and prioritize work.
• Exposure to public cloud infrastructure (SaaS, IaaS, and PaaS).

Technologies

SIEM, IDS/IPS, firewalls, email, endpoint detection and response (EDR) systems, MSSP, ITSM (ServiceNow / Confluence), ServiceNow, Confluence, MITRE ATT&CK, OWASP Top 10, NIST, EDR, IAM, Python, PowerShell, KQL, SOAR, OpenCTI, Recorded Future, MISP, CompTIA Security+, CySA+, CEH, SANS, Cloud Certifications.

Nice to Have

• 1+ years of experience within Incident Response and/or Security Operations.
• Scripting or automation experience (Python, PowerShell, KQL) to enhance SOC playbooks, enrich alerts, or reduce manual triage effort.
• Exposure to SOAR platforms and use-case development for automating repeatable response actions.
• Experience working alongside an MSSP or within a co-managed SOC model.
• Familiarity with threat intelligence platforms (OpenCTI, Recorded Future, MISP) and applying CTI to detection and hunting.
• Relevant Information Security certifications (for example CompTIA Security+, CySA+, CEH, SANS, Cloud Certifications).

Location and Work Model

Denver, CO (hybrid). Hybrid working and reasonable accommodations are supported.

Compensation and Posting Details

• Base salary range: USD 110,000 - 120,000 per year. Range is estimated for the role and actual pay may vary.
• This position will be open through November 15, 2026.
• Colorado law requires an estimated closing date for job postings; applicants should not be discouraged if the date shown has passed.
• Internal posting duration: minimum of five calendar days.

Internal Applicant Notes

• Internal applicants must inform their current supervisor/manager prior to applying.
• Internal applicants must be in “good standing,” defined as a performance rating of “met all objectives” or higher.
• Internal applicants cannot be on a current performance improvement plan or written warning, and must have been in the current role for a minimum of 6 months unless approved for early transfer by their current leader and the People Department.

Benefits

• Generous Holiday policies.
• Excellent Health and Wellbeing benefits, including corporate membership to Wellhub.
• Paid volunteer time.
• Professional development support, including professional development courses and tuition/qualification reimbursement.
• Maternal/paternal leave benefits and family services.
• Unique employee events and programs, including a 14er challenge.
• Complimentary beverages, snacks, and all employee Happy Hours.
• Annual Bonus Opportunity: position may be eligible for an annual discretionary bonus award from the profit pool.
• Additional total rewards package elements may include competitive compensation and pension/retirement plans, along with various health, wellbeing, and lifestyle benefits.

Additional Expectations

• Flexible working hours may require scheduled work on weekends and/or holidays, including being on-call.
• On-call rotations include triage and escalation support.
• Perform other duties as assigned.