Senior Security Analyst, Cyber Defense

SPS Commerce, Inc.; Minneapolis (MN); Hybrid; USD 108,200 - 140,000; Full time

Job summary

SPS Commerce is seeking a Senior Security Analyst to lead the Cyber Defense team, drive detection, response, and incident management across the SOC. You will oversee escalated investigations, perform proactive threat hunting, and mentor analysts in a hybrid Minneapolis-based role with remote options.

Required are 5+ years in security operations, DFIR depth, and experience with SIEM/EDR, MITRE ATT&CK, and cloud security. CrowdStrike and SOAR experience are preferred.

Qualifications

• 5+ years in security operations, incident response, or threat detection with DFIR and SOC experience.
• Hands-on experience with SIEM/EDR and cross-domain investigations end-to-end.
• Strong evidence-handling, disk/memory/log analysis, and threat modeling.

Responsibilities

• Lead alert triage and investigation, integrating SIEM/EDR data and cloud telemetry.
• Take point on high-severity incidents, coordinate with stakeholders, and document outcomes.
• Proactively hunt threats using threat intel and coverage gap analysis.
• Incorporate AI/automation to speed investigations and reduce manual work.
• Mentor SOC team members and participate in on-call rotations.

Skills

DFIR

SIEM/EDR

Threat hunting

MITRE ATT&CK

Cloud security

Executive briefing

Education

Bachelor's degree in a related field

Tools

CrowdStrike EDR

SOAR platforms

CrowdStrike NG-SIEM

AWS Cloud Monitoring

Terraform

Job description

## Senior Security Analyst, Cyber DefenseApplylocations: US MN Minneapolis Office: United States Remotetime type: Full timeposted on: Posted 2 Days Agojob requisition id: R-001088# **Description:**SPS Commerce is a leading provider of cloud-based supply chain management solutions, serving a global network of retail trading partners. We foster a collaborative and inclusive work environment where innovation and continuous improvement are highly valued. Join SPS Commerce and be part of a dynamic team that's transforming the global retail supply chain!# **Position Summary:**A senior member of the Cyber Defense team who leads detection and response work and provides day-to-day leadership of the SOC. This individual serves as a technical leader — setting the cultural tone, modeling high standards, and managing the SOC queue to keep work prioritized and moving. They collaborate closely across exposure management, security engineering, and cloud security. This role owns escalated investigations, takes point on escalated incidents, and proactively hunts threats across the enterprise. Success is measured by timely, high-quality investigations, effective incident response, a well-prioritized SOC, and clear documentation that enables consistent operations and continuous improvement.**Key Responsibilities:*** **Lead alert triage and investigation:** Serve as the escalation point for alerts raised by the managed SOC and monitoring systems. Pull together the full picture from whatever the investigation calls for: SIEM, EDR, identity and authentication activity, cloud audit trails, network and email telemetry, and other sources as the evidence leads. Reach accurate, defensible determinations under time pressure and decide what warrants escalation to a full incident.* **Run incident response:** Take point on confirmed higher-severity incidents: scoping, containment, coordinating with affected stakeholders, and keeping leadership informed with clear, timely updates. Document incidents thoroughly and drive them to genuine closure, not just ticket closure.* **Hunt for what monitoring misses:** Perform proactive threat hunting informed by current threat intelligence, surfacing coverage gaps and emerging risk before they become incidents.* **Work AI and automation into the daily craft:** Use AI-assisted tooling to accelerate investigation, summarization, and documentation, and identify where AI and automation can reduce repetitive manual work, speed response, or close gaps—partnering with engineering to make it real.* **Partner across the team:** Collaborate with exposure management on triage, prioritization, and remediation tracking, and work with security engineering and cloud security where investigations and detections cross over.* **Sharpen detections and tooling:** Execute established runbooks, identify stale or missing guidance, and feed concrete improvement requests back to engineering to strengthen detections, automations, and documentation.* **Develop the SOC:** Review SOC determination and escalation quality and provide coaching and feedback that helps analysts grow.* Participate in the team's on-call rotation.* Perform other duties as assigned.**Required Qualifications:*** 5+ years in security operations, incident response, or threat detection, with senior-level depth in digital forensics and incident response (DFIR) and SOC work.* Hands-on investigation experience with a SIEM and an EDR platform—the specific products matter less than the ability to search, pivot across identity, cloud, and network log sources, and scope an incident end to end.* Sound evidence-handling practice and forensic fundamentals, including preserving and reasoning over disk, memory, and log artifacts.* A working understanding of adversarial behavior (e.g., MITRE ATT&CK).* Working familiarity with exposure management workflows—triage, prioritization, and remediation tracking.* Clear written and verbal communication, with the judgment to brief both engineers and executives appropriately.* A collaborative working style and genuine curiosity about security and technology—a seasoned professional who exercises sound judgment and collaborates effectively across a larger organization.* Internal candidates: SOC, security operations, or security engineering experience handling escalated investigations or incident response and working across detection, vulnerability management, or cloud security functions, with at least 1 year of SPS experience.* **Key Skills:** Digital forensics and incident response (DFIR), SIEM/EDR investigation, threat hunting, adversarial behavior analysis (MITRE ATT&CK), cloud security monitoring, cross-team communication and executive briefing.**Preferred Qualifications:*** Experience with Crowdstrike as an EDR platform.* Experience with SOAR platforms.* Experience with Crowdstrike NG-SIEM.* Cloud security monitoring experience, primarily AWS, with some exposure to Azure and GCP, and container environments such as EKS.* Windows Defender XDR.* Python programming experience for scripting, automation, or tooling.* Familiarity with infrastructure-as-code (e.g., Terraform, CloudFormation) and CI/CD pipelines, and how to investigate and secure them.* Familiarity with one or more of Oracle, Snowflake, Databricks, and the Atlassian suite.* Proactive threat hunting and threat-intelligence experience.**Location:**This role follows a hybrid work model for candidates based in Minneapolis, MN and is also open to 100% remote candidates. **What We Offer:**At SPS Commerce, we are committed to ensuring that each employee's compensation reflects their unique experiences, performance, and skills in their role. The salary range for this role considers several factors, including education, relevant skills, work history, certifications, location, and more.The annual salary range for this role is: $108,200.00 – $140,000.00 USD. The actual salary offered will be determined based on the factors listed above and may fall anywhere within the range.SPS Commerce offers a comprehensive benefits package designed to support employees' health, well-being, and financial security. Benefits are country-specific and aligned with local laws and market practices.#LI-TB1