Senior Threat Detection & Response Analyst

Insight Global; Wilmington (DE); On-site; USD 150,000 - 190,000; Full time

Job summary

Insight Global is seeking a hands-on Senior Threat Detection & Response Analyst to manage complex security incidents across endpoints, identity, email, network, cloud, and SaaS environments. You will work in an AI-augmented SOC, automate repetitive tasks, and mentor junior analysts.

The role requires 10+ years in cybersecurity with hands-on IR/IR experience, experience with CrowdStrike Falcon and Microsoft Defender XDR, and strong automation skills using Python/PowerShell.

Qualifications

• Minimum 10+ years in cybersecurity with hands-on SOC or IR experience in enterprise environments.
• Proven ability to manage complex incidents end-to-end (e.g., BEC, credential compromise, ransomware precursors).
• Strong investigation skills with CrowdStrike Falcon and/or Microsoft Defender XDR; hands-on with SIEMs.
• Experience with Azure/AWS security logs and cloud incident response.
• Proficient in automating tasks using Python/PowerShell and SOAR/Logic Apps.

Responsibilities

• Own complex security incidents end-to-end: triage, investigation, containment, eradication, recovery, and closure.
• Investigate threats across endpoint, identity, email, network, cloud, and SaaS to determine root cause and scope.
• Triage high-severity alerts from major security platforms and coordinate containment actions.
• Lead threat hunting using KQL and MITRE ATT&CK to improve detections and runbooks.
• Automate repetitive tasks with Python, PowerShell, SOAR playbooks, or AI-agent workflows.
• Mentor junior analysts and serve as escalation point for MDR/MSSP partners.
• Participate in on-call rotation for critical incidents.

Skills

Cybersecurity experience

Incident response

Threat detection

AI-assisted security tools

MITRE ATT&CK

Tools

CrowdStrike Falcon

Microsoft Defender XDR

Azure/AWS security logs

Python automation

PowerShell automation

SOAR / Logic Apps

Job description

Job Description

We are seeking a hands-on Senior Threat Detection & Response Analyst to manage complex security incidents from initial alert through containment, recovery, and closure across endpoint, identity, email, network, cloud, and SaaS environments.

This person will work within an AI-augmented SOC, using AI-assisted tools to accelerate investigations while independently validating their output. They will also automate repetitive analyst tasks, improve detections and runbooks, and mentor junior analysts.

Key Responsibilities

• Own complex security incidents end to end, including triage, investigation, containment, eradication, recovery, documentation, and closure.
• Investigate threats across endpoint, identity, email, network, Azure, AWS, and SaaS environments to determine root cause, attack path, scope, and business impact.
• Triage high‑severity alerts from CrowdStrike Falcon, Microsoft Defender XDR, CrowdStrike Next‑Gen SIEM, Wiz, Defender for Cloud, and related security platforms.
• Coordinate containment actions such as host isolation, account disablement, token revocation, credential resets, IOC blocking, and email purges.
• Conduct threat hunting using KQL, CrowdStrike Query Language, and EDR tools, applying MITRE ATT&CK to analyze attacker activity and recommend detection improvements.
• Use tools such as Microsoft Security Copilot and CrowdStrike Charlotte AI to accelerate enrichment, analysis, query generation, timeline creation, and reporting while validating all AI‑generated findings.
• Automate repetitive investigation and response tasks using Python, PowerShell, SOAR playbooks, Logic Apps, KQL, or AI‑agent workflows.
• Lead post‑incident reviews, maintain response runbooks, mentor junior analysts, and serve as an escalation point for MDR/MSSP partners.
• Participate in the on‑call rotation for critical security incidents.

Skills and Requirements

• 10+ years of cybersecurity experience, including at least 7 years of hands‑on SOC, incident response, or threat detection and response experience in enterprise environments.
• Proven experience managing complex incidents end to end, such as business email compromise, credential compromise, ransomware precursors, cloud account compromise, or data exfiltration.
• Deep hands‑on investigation experience with CrowdStrike Falcon and/or Microsoft Defender XDR.Advanced KQL experience and hands‑on experience with CrowdStrike Next‑Gen SIEM or a comparable SIEM.
• Working knowledge of Azure and AWS security logs and cloud incident response.
• Strong understanding of Entra ID/Active Directory, Microsoft 365, Windows, Linux, and common attacker techniques.
• Experience automating analyst tasks using Python, PowerShell, SOAR, or similar tools.
• Hands‑on experience using AI‑assisted security tools or generative AI during investigations, including independently validating AI‑generated output.
• Strong written communication skills, including the ability to summarize incidents for nontechnical leadership.
• Experience with agentic SOC capabilities or autonomous triage agents in production.
• Experience with CrowdStrike, Wiz, Microsoft Defender for Cloud, AWS GuardDuty, or Defender for Cloud Apps.Digital forensics experience involving memory, disk, or cloud‑log analysis.
• Malware analysis or reverse‑engineering fundamentals.Prompt‑engineering experience for security investigations.
• Experience in regulated industries such as pharmaceutical, life sciences, healthcare, or financial services.
• Certifications such as GCIH, GCFA, GCIA, Microsoft SC‑200, CrowdStrike CCFR, or CrowdStrike CCFH. Proven hands‑on ability is valued more than certifications.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [e-mail].