Sr. Threat Detection Analyst

Franchise World Headquarters, LLC

Shelton (CT)

Hybrid

USD 103,000 - 128,000

Full time

14 days+

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Insurance Plans (medical, dental)

Pension/401K/RSP

Competitive Bonus

Mobility Allowance

Tuition Reimbursement

Company Holidays

Volunteering time

Job summary

Subway is seeking a Sr. Threat Detection Analyst to join the SOC in Shelton, CT. This senior, escalation-level role combines hands-on investigation with threat intelligence to validate alerts and guide incident handling.

You will mentor junior analysts, tune detections, and drive playbook improvements in a hybrid work setting. The ideal candidate has 5+ years in SOC/threat detection, strong EDR/SIEM experience, and deep knowledge of Microsoft 365 security and cloud postures.

Qualifications

5+ years of experience in a SOC analyst or threat detection role, including senior or escalation-level investigation work.
Hands-on experience with endpoint detection and response (EDR) tools, and practical experience with SIEM or log analysis platforms.
Working knowledge of identity security and SSO platforms including Microsoft Entra ID and Okta, and understanding of network security fundamentals, firewalls, and web application and API protection.
Experience securing a Microsoft 365 environment, Defender, Exchange Online, and Purview, and familiarity with Wiz for cloud security posture management.
Familiarity with MITRE ATT&CK framework and attacker tactics, OSINT enrichment to support investigations.
Ability to read and reason about detection logic to identify tuning opportunities.
Strong written communication for incident docs and analyst handoffs.

Responsibilities

Serve as a senior escalation point for alerts triaged by junior analysts and determine scope and business impact.
Build attack timelines and identify indicators of compromise using CrowdStrike and threat intel.
Investigate and respond to threats across the Microsoft 365 environment and Wiz cloud findings.
Execute and refine incident response playbooks across multiple threat categories.
Escalate high-severity or complex incidents with thorough handoff documentation.
Mentor junior analysts and contribute to detection tuning and playbook improvements.
Communicate findings clearly with employees and stakeholders during investigations.
Document investigation steps and remediation actions for audit and compliance readiness.

Skills

SOC escalation

EDR

SIEM

Identity security

Threat intel

MITRE ATT&CK

OSINT

Tools

CrowdStrike Falcon Next-Gen SIEM

Microsoft Defender

Purview

Wiz

Microsoft Entra ID

Okta

Palo Alto PAN-OS

Akamai App and API Protector

Job description

Sr. Threat Detection Analyst

Ready to build what's next with one of the world's most iconic brands?

Why Join Subway?

At Subway, we are not standing still. We are building.

This is a business focused on what matters most: growing franchisee profitability, strengthening our brand and creating long-term value. The people who thrive here are the ones who want to make a real impact.

You will not just do the work. You will shape it.

We move fast. We think like owners. We make decisions that

matter. We hold ourselves to a high standard because what we do directly impacts thousands of franchisees around the world.

If you bring energy, accountability and a bias for action,

you will fit right in.

We take the work seriously, but we also know the best

results come from teams that support each other, celebrate wins and show up ready to build something better every day.

This is your chance to be part of what's next.

Position Overview

The Sr. Threat Detection Analyst is a senior, escalation-level analyst on the SOC team, combining hands-on investigation with threat intelligence to validate and contextualize alerts escalated by junior analysts. This is an individual contributor role with no direct reports, though mentorship and technical guidance to junior analysts are a core part of the job. The Sr. Threat Detection Analyst determines the scope and impact of escalated alerts, drives incidents toward resolution or a clean handoff for the most complex cases, and works to raise the skill level of the broader analyst team through coaching.

Responsibilities

Serve as a senior escalation point for alerts triaged by junior analysts, correlating signals across multiple security tools to validate true positives, rule out false positives, and determine the scope and business impact of an incident.
Build attack timelines and identify indicators of compromise using CrowdStrike Falcon Next-Gen SIEM, applying threat intelligence, including IOCs, threat actor tactics and techniques, and OSINT research, to enrich investigations and inform escalation decisions.
Investigate and respond to threats across the Microsoft 365 environment, including Microsoft Defender (Office 365, Endpoint, Cloud Apps), Exchange Online, and Purview compliance and DLP alerts; triage and act on cloud security findings from Wiz, including active threats, misconfigurations, vulnerabilities, and exposure risks.
Execute and continuously refine incident response playbooks across categories including account takeover and credential stuffing, phishing and email based threats, insider threat and data exfiltration, endpoint and EDR detections and false positive disposition, network, firewall, and command and control activity, identity and SSO anomalies, DDoS, botnet, and web attacks, security coverage and hygiene gaps, and ransomware.
Escalate confirmed, high severity, or technically complex incidents with clear, complete handoff documentation.
Understand the logic behind detection rules and alerts well enough to identify tuning opportunities, feeding recommendations into the broader detection tuning workflow to reduce noise and improve detection fidelity.
Contribute to playbook improvement based on patterns and trends observed during investigations.
Mentor and coach junior analysts on triage methodology, investigation technique, and tool usage, building team capability without formal performance management responsibility.
Communicate directly with employees and business stakeholders during investigations, explaining findings and next steps clearly and calmly, even in stressful or sensitive situations.
Document investigation steps, findings, and remediation actions thoroughly in the case management system, in line with SOC incident response procedures, and support audit and compliance readiness by ensuring investigation records meet internal and regulatory documentation standards.
Participate in on call or rotational shift coverage as needed to support SOC operations. [confirm schedule/on-call expectations]

Qualifications

5+ years of experience in a SOC analyst or threat detection role, including senior or escalation-level investigation work.
Hands-on experience with endpoint detection and response (EDR) tools, and practical experience with SIEM or log analysis platforms.
Working knowledge of identity security and SSO platforms including Microsoft Entra ID and Okta, and understanding of network security fundamentals, firewalls, and web application and API protection (Palo Alto PAN-OS, Akamai App and API Protector).
Experience securing a Microsoft 365 environment, including Defender, Exchange Online, and Purview, and familiarity with cloud security posture management tools such as Wiz.
Familiarity with the MITRE ATT&CK framework and common attacker tactics and techniques, and experience applying threat intelligence, such as IOC enrichment and OSINT research, to support investigations.
Ability to read and reason about detection logic, such as correlation rules and alert conditions, well enough to identify tuning opportunities.
Strong written communication skills for incident documentation and analyst to analyst handoffs, and strong interpersonal skills, with the ability to guide non-technical employees through a security incident calmly, clearly, and without judgment.
Ability to work hybrid out of the Shelton, CT office (4 days in office, 1 day remote).

Preferred Qualifications

Experience with additional tools in a modern security stack, such as email security, asset and exposure management, microsegmentation, web application firewalls, and security awareness and phishing simulation platforms, as well as threat intelligence platforms or feeds to support proactive detection and campaign correlation.
Industry certifications such as GCIH, GCFA, GCTI, CompTIA Security+/CySA+, or CEH.
Basic scripting or automation experience in Python or PowerShell to support detection tuning.
Prior experience informally mentoring or training junior analysts.
Experience with ServiceNow or similar case and incident management tooling.

Growth Path

This role offers a strong foundation for growth within threat detection, with opportunities over time to take on more advanced investigation work, detection engineering exposure, and increased technical responsibility

What do we offer?