Senior Security Analyst

Jobtailor; Seattle (WA); On-site; USD 150,000 - 180,000; Full time

Job summary

Jobtailor in Seattle seeks an experienced security monitoring lead to oversee real-time detection, incident response, and threat analysis across cloud and corporate environments.

You will design scalable alerting, mentor analysts, and drive metrics to improve detection fidelity in a fast-paced, collaborative setting.

Qualifications

• 5+ years hands-on experience with SIEM platforms and endpoint detection tools.
• Expertise in designing and tuning complex detection rules and alert logic.
• Deep knowledge of network and endpoint security, threat actor TTPs, and mitigations.
• Experience in proactive threat hunting and vulnerability management.
• Leadership in driving security program initiatives and cross-team alignment.
• Excellent technical writing, incident reporting, and mentoring skills.
• Proficiency with scripting and query languages (Python, Bash, SQL).
• Experience with Linux, Windows, and macOS.
• Comfortable in a fast-paced, collaborative, growth-focused environment.

Responsibilities

• Lead real-time monitoring, triage, and analysis of complex security events.
• Engineer and automate advanced detection use cases across cloud and corporate environments.
• Develop and report on metrics for monitoring effectiveness and incident response.
• Own and evolve the security monitoring program strategy.
• Collaborate with Infrastructure Security Engineers to manage data pipelines.
• Perform proactive threat hunting and investigations to uncover threats.
• Mentor and guide junior analysts during incident response.
• Coordinate threat analysis using historical data and diagrams.
• Close monitoring gaps with multiple teams and improve security posture.
• Optimize tools and automate response workflows to reduce false positives.
• Create and maintain playbooks, runbooks, and detection documentation.

Skills

SIEM platforms

Endpoint detection

Detection rules

Threat hunting

Vulnerability management

Leadership

Communication

Python

Bash

SQL

Linux

Windows

macOS

Job description

Responsibilities

• Lead real‑time monitoring, triage, and analysis of complex security events, providing verifiable assessments of threats and incident severity.
• Engineer and automate advanced detection use cases across DigitalOcean’s cloud and corporate environments, leveraging deep knowledge of adversary TTPs to design and implement scalable alerting solutions.
• Develop, track, and report on key metrics for security monitoring effectiveness and incident response performance, using data to drive improvements.
• Own and evolve the security monitoring program strategy, ensuring alignment with evolving threat landscapes and business priorities.
• Work closely with Infrastructure Security Engineers to identify log sources, integrate, and maintain data pipelines (e.g., log sources, forwarders, parsing, enrichment).
• Perform proactive threat hunting and hypothesis‑driven investigations, uncovering hidden or emerging threats within DigitalOcean’s environments.
• Mentor and guide lower level analysts, reviewing escalated incidents and providing technical leadership during incident response.
• Coordinate threat analysis using historical data and architecture diagrams to identify attack vectors.
• Collaborate with multiple teams to close monitoring gaps and improve overall security.
• Optimize security tools and processes to reduce false positives, improve detection fidelity, and automate response workflows where appropriate.
• Lead the creation and maintenance of detailed playbooks, runbooks, and documentation to standardize detection and response efforts.

Requirements

• 5+ years of hands‑on experience with SIEM platforms and endpoint detection tools
• Demonstrated expertise in designing and tuning complex detection rules and alerting logic across diverse environments
• Deep understanding of network and endpoint security, attack methodologies, threat actor tactics, and mitigation strategies
• Experience in proactive threat hunting, vulnerability management, and coordinating with red teams or penetration testers
• Proven leadership in driving security program initiatives, setting metrics, and influencing cross‑team security strategy
• Excellent communication skills for technical documentation, incident reporting, and mentoring less experienced analysts
• Proven experience with scripting and query languages (Python, Bash, SQL) to automate detection and response workflows
• Demonstrated proficiency in Linux, Windows, and macOS
• Comfortable working in a fast‑paced environment with a collaborative and growth‑focused mindset

Core Competencies

Demonstrates expertise in security monitoring, incident response, and threat analysis, with a strong focus on automation and metrics‑driven improvements. Proficient in leading security initiatives and mentoring teams while optimizing detection and response workflows.