Senior Threat & Incident Response Security Ops

Blackstone Talent Group; San Francisco (CA); On-site; USD 120,000 - 150,000; Full time

Job summary

Blackstone Talent Group is seeking a security operations professional to own investigations end to end, tune a new SIEM, and mentor junior analysts. You will perform deep-dive threat analyses across multiple domains and serve as escalation for complex incidents.

The role requires hands-on experience with CrowdStrike NG-SIEM, strong AWS security knowledge, and scripting abilities for automation. Strong communication and leadership in a fast-paced environment are essential.

Qualifications

• 3+ years on an IT security operations/IR team with independent investigations.
• Deep forensic and incident response analysis of complex business systems.
• Hands-on with modern SIEM platforms; CrowdStrike NG-SIEM preferred.
• Substantial AWS security experience: WAF, RDS, S3, CloudTrail/Athena.
• Applied threat intelligence across IP, email, telephony, domain/file reputation.

Responsibilities

• Lead deep-dive threat analysis across multiple sources to create actionable detections.
• Escalate for security incident detection, response, containment, and recovery including forensic work.
• Tune and mature detection content in CrowdStrike NG-SIEM; reduce false positives.
• Analyze and correlate large-scale logs across AWS and enterprise systems.

Skills

Threat analysis

Incident response

SIEM engineering

AWS security

Threat intelligence

Cross-platform security

Scripting (Python/PowerShell/Bash)

Education

Bachelor's degree in CS/IT/CIS

Professional security certifications (CISSP/GCIA/GCFA/S+, CCNA)

Tools

CrowdStrike NG‑SIEM

S3/Athena

Pathlock

Entrust

PeopleSoft HCM

Job description

Blackstone Talent Group is seeking a security operations professional to own investigations end to end, tune a new SIEM, and mentor junior analysts. You will perform deep-dive threat analyses across multiple domains and serve as escalation for complex incidents.

The role requires hands-on experience with CrowdStrike NG-SIEM, strong AWS security knowledge, and scripting abilities for automation. Strong communication and leadership in a fast-paced environment are essential.