Senior SOC Threat Detection & Incident Lead

Subway; Shelton (CT); Hybrid; USD 103,000 - 128,000; Full time

Benefits offered by this job

Insurance plans

401K

Bonus

Mobility allowance

Tuition reimbursement

Company holidays

Volunteering time

Job summary

Subway is seeking a Sr. Threat Detection Analyst to join its Security Operations Center in Shelton, CT. You will combine hands-on investigations with threat intelligence to validate alerts escalated by junior analysts and guide incidents toward resolution.

This senior, individual-contributor role emphasizes mentoring junior analysts, refining playbooks, and communicating findings to stakeholders. You will work in a hybrid setup, using CrowdStrike, Defender, Wiz, and other tools to harden

Qualifications

• 5+ years in a SOC analyst or threat detection role.
• Hands-on experience with EDR tools and SIEM/log analysis.
• Knowledge of identity security and SSO platforms (Entra ID, Okta).
• Experience securing Microsoft 365 environment (Defender, Exchange Online, Purview).
• Understanding of MITRE ATT&CK and threat intelligence usage.
• Ability to read and tune detection logic.
• Strong written communication and stakeholder liaison skills.
• Hybrid work from Shelton, CT (4 days in office, 1 day remote).

Responsibilities

• Serve as senior escalation point for alerts, correlate signals across security tools to validate true positives and determine incident impact.
• Build attack timelines and identify indicators of compromise using CrowdStrike Falcon and threat intel.
• Investigate and respond to threats across Microsoft 365 (Defender, Exchange Online, Purview) and Wiz findings.
• Execute and refine incident response playbooks across multiple categories including identity, network, and ransomware.
• Escalate high-severity or complex incidents with complete handoff documentation.
• Identify tuning opportunities in detection rules to reduce noise and improve fidelity.
• Contribute to playbook improvements based on investigation patterns.
• Mentor and coach junior analysts on triage and investigations.
• Communicate findings clearly to employees and stakeholders during investigations.
• Document steps in case management system and support audit readiness.
• Participate in on-call or rotational shifts as needed.

Skills

5+ years SOC experience

EDR experience

SIEM / log analysis

Identity security

MITRE ATT&CK familiarity

Strong written comms

Tools

CrowdStrike Falcon

Microsoft Defender

Purview

Wiz

Entra ID

Okta

Job description

Subway is seeking a Sr. Threat Detection Analyst to join its Security Operations Center in Shelton, CT. You will combine hands-on investigations with threat intelligence to validate alerts escalated by junior analysts and guide incidents toward resolution.

This senior, individual-contributor role emphasizes mentoring junior analysts, refining playbooks, and communicating findings to stakeholders. You will work in a hybrid setup, using CrowdStrike, Defender, Wiz, and other tools to harden