Senior SOC Fraud Analyst & Incident Playbook Lead

Citi; Irving (TX); On-site; USD 126,000 - 189,000; Full time

Job summary

Citi's Irving, Texas-based SOC is seeking a Senior SOC Analyst (L2) to monitor, triage, and deeply analyze security events across endpoints, networks, and data environments. You will mentor L1 analysts, lead incident response efforts, and help design new use cases leveraging AI/LLM tools.

You will collaborate with Incident Response and cross-functional teams to ensure compliance with security policies, while driving automation and continuous improvement in the SOC.

Qualifications

• Advanced knowledge of cyber-enabled fraud TTPs (e.g., account takeover, payment fraud).
• Extensive hands-on experience investigating and managing complex fraud incidents.
• Proficient in data analytics and query languages (SQL, Python, SAS, R).
• Strong web security and network traffic analysis knowledge.
• Experience with big data technologies and data warehouses.

Responsibilities

• Monitor and triage alerts from SIEM/EDR/IDS/IPS 24x7 as escalation lead.
• Perform Level 2 peer reviews of L1 analysis for accuracy and adherence.
• Lead rapid response and containment for active fraud incidents.
• Document actions, findings, and decisions in case management.
• Design SOC playbooks and SOPs for cyber-fraud scenarios.
• Lead development of new AI/LLM use cases for analysis and response.
• Support governance including documentation standards and escalation paths.
• Mentor L1 analysts to foster improvement and excellence.
• Provide guidance on cyber-fraud analysis and data interrogation.
• Identify recurring fraud patterns and trend insights.

Skills

Cyber-fraud analytics

Data analytics

SQL

Python

R

SAS

Incident response

24x7 monitoring

Education

Bachelor’s degree in Data Science or CS

Tools

Hadoop

Spark

Tableau

Power BI

SIEM

EDR

Job description

Citi's Irving, Texas-based SOC is seeking a Senior SOC Analyst (L2) to monitor, triage, and deeply analyze security events across endpoints, networks, and data environments. You will mentor L1 analysts, lead incident response efforts, and help design new use cases leveraging AI/LLM tools.

You will collaborate with Incident Response and cross-functional teams to ensure compliance with security policies, while driving automation and continuous improvement in the SOC.