Senior SOC Cyber Fraud & Incident Response Lead

Citigroup Inc.; Irving (TX); On-site; USD 126,000 - 189,000; Full time

Job summary

Citigroup Inc. in Irving, TX is seeking a SOC Analyst (L2) to monitor, triage, and analyze security events across endpoints, networks, and applications. You will mentor L1 analysts, design SOC playbooks, and drive use cases for AI/LLM tools while coordinating rapid containment for fraud incidents.

The role emphasizes collaboration across business units, adherence to security policy, and ongoing improvements in automation and incident response. 6–10 years of relevant experience preferred.

Qualifications

• Advanced knowledge of cyber-enabled fraud TTPs including account takeover and payment fraud.
• Hands-on experience investigating complex fraud incidents in an enterprise SOC.
• Data analytics using SQL, Python, SAS, or R to interrogate large datasets.
• Strong web application defense knowledge and network traffic analysis.
• Experience with big data tech, ETL, data warehouses, BI platforms.
• Understanding of OWASP Top 10 and API security, plus risk assessment.
• Ability to correlate logs across network, endpoint, WAF, and app data.
• Proven leadership in fraud incident response and mentoring analysts.
• Typically 6–10 years in cyber-fraud analysis or related roles.

Responsibilities

• Perform 24x7 monitoring and triage of alerts from SIEM, EDR, IDS/IPS and fraud tools.
• Lead Level 2 peer review of L1 analysis to ensure accuracy and adherence to procedures.
• Coordinate rapid response and containment for active fraud incidents.
• Document actions and findings in case management system for escalation-ready records.
• Design and implement advanced SOC playbooks and SOPs for cyber-fraud scenarios.
• Lead use-case development for AI/LLM tools to enhance analysis and threat hunting.
• Support SOC governance and mentor L1 analysts; drive continuous improvement.
• Identify malware-related activity and elevate artifacts per procedures.

Skills

Fraud analysis

Data analytics

SQL

Python

SAS/R

Web app security

Big data

Incident response

Log correlation

Education

Bachelor’s degree in Data Science, Computer Science, Information Systems, or related field

Tools

SIEM

EDR

IDS/IPS

WAF

Bot Defense

Tableau

Power BI

Hadoop

Spark

ETL

RDBMS

Job description

Citigroup Inc. in Irving, TX is seeking a SOC Analyst (L2) to monitor, triage, and analyze security events across endpoints, networks, and applications. You will mentor L1 analysts, design SOC playbooks, and drive use cases for AI/LLM tools while coordinating rapid containment for fraud incidents.

The role emphasizes collaboration across business units, adherence to security policy, and ongoing improvements in automation and incident response. 6–10 years of relevant experience preferred.