Sr. Threat Detection Analyst

Subway; Shelton (CT); Hybrid; USD 103,000 - 128,000; Full time

Benefits offered by this job

Insurance plans

401K

Bonus

Mobility allowance

Tuition reimbursement

Company holidays

Volunteering time

Job summary

Subway is seeking a Sr. Threat Detection Analyst to join its Security Operations Center in Shelton, CT. You will combine hands-on investigations with threat intelligence to validate alerts escalated by junior analysts and guide incidents toward resolution.

This senior, individual-contributor role emphasizes mentoring junior analysts, refining playbooks, and communicating findings to stakeholders. You will work in a hybrid setup, using CrowdStrike, Defender, Wiz, and other tools to harden

Qualifications

• 5+ years in a SOC analyst or threat detection role.
• Hands-on experience with EDR tools and SIEM/log analysis.
• Knowledge of identity security and SSO platforms (Entra ID, Okta).
• Experience securing Microsoft 365 environment (Defender, Exchange Online, Purview).
• Understanding of MITRE ATT&CK and threat intelligence usage.
• Ability to read and tune detection logic.
• Strong written communication and stakeholder liaison skills.
• Hybrid work from Shelton, CT (4 days in office, 1 day remote).

Responsibilities

• Serve as senior escalation point for alerts, correlate signals across security tools to validate true positives and determine incident impact.
• Build attack timelines and identify indicators of compromise using CrowdStrike Falcon and threat intel.
• Investigate and respond to threats across Microsoft 365 (Defender, Exchange Online, Purview) and Wiz findings.
• Execute and refine incident response playbooks across multiple categories including identity, network, and ransomware.
• Escalate high-severity or complex incidents with complete handoff documentation.
• Identify tuning opportunities in detection rules to reduce noise and improve fidelity.
• Contribute to playbook improvements based on investigation patterns.
• Mentor and coach junior analysts on triage and investigations.
• Communicate findings clearly to employees and stakeholders during investigations.
• Document steps in case management system and support audit readiness.
• Participate in on-call or rotational shifts as needed.

Skills

5+ years SOC experience

EDR experience

SIEM / log analysis

Identity security

MITRE ATT&CK familiarity

Strong written comms

Tools

CrowdStrike Falcon

Microsoft Defender

Purview

Wiz

Entra ID

Okta

Job description

Ready to build what’s next with one of the world’s most iconic brands?

Why Join Subway?

At Subway, we are not standing still. We are building. This is a business focused on what matters most: growing franchisee profitability, strengthening our brand and creating long-term value. The people who thrive here are the ones who want to make a real impact. You will not just do the work. You will shape it. We move fast. We think like owners. We make decisions that matter. We hold ourselves to a high standard because what we do directly impacts thousands of franchisee around the world. If you bring energy, accountability and a bias for action, you will fit right in. We take the work seriously, but we also know the best results come from teams that support each other, celebrate wins and show up ready to build something better every day. This is your chance to be part of what’s next.

Position Overview

The Sr. Threat Detection Analyst is a senior, escalation-level analyst on the SOC team, combining hands‑on investigation with threat intelligence to validate and contextualize alerts escalated by junior analysts. This is an individual contributor role with no direct reports, though mentorship and technical guidance to junior analysts are a core part of the job. The Sr. Threat Detection Analyst determines the scope and impact of escalated alerts, drives incidents toward resolution or a clean handoff for the most complex cases, and works to raise the skill level of the broader analyst team through coaching.

Responsibilities

• Serve as a senior escalation point for alerts triaged by junior analysts, correlating signals across multiple security tools to validate true positives, rule out false positives, and determine the scope and business impact of an incident.


• Build attack timelines and identify indicators of compromise using CrowdStrike Falcon Next-Gen SIEM, applying threat intelligence, including IOCs, threat actor tactics and techniques, and OSINT research, to enrich investigations and inform escalation decisions.


• Investigate and respond to threats across the Microsoft 365 environment, including Microsoft Defender (Office 365, Endpoint, Cloud Apps), Exchange Online, and Purview compliance and DLP alerts; triage and act on cloud security findings from Wiz, including active threats, misconfigurations, vulnerabilities, and exposure risks.


• Execute and continuously refine incident response playbooks across categories including account takeover and credential stuffing, phishing and email based threats, insider threat and data exfiltration, endpoint and EDR detections and false positive disposition, network, firewall, and command and control activity, identity and SSO anomalies, DDoS, botnet, and web attacks, security coverage and hygiene gaps, and ransomware.


• Escalate confirmed, high severity, or technically complex incidents with clear, complete handoff documentation.


• Understand the logic behind detection rules and alerts well enough to identify tuning opportunities, feeding recommendations into the broader detection tuning workflow to reduce noise and improve detection fidelity.


• Contribute to playbook improvement based on patterns and trends observed during investigations.


• Mentor and coach junior analysts on triage methodology, investigation technique, and tool usage, building team capability without formal performance management responsibility.


• Communicate directly with employees and business stakeholders during investigations, explaining findings and next steps clearly and calmly, even in stressful or sensitive situations.


• Document investigation steps, findings, and remediation actions thoroughly in the case management system, in line with SOC incident response procedures, and support audit and compliance readiness by ensuring investigation records meet internal and regulatory documentation standards.


• Participate in on call or rotational shift coverage as needed to support SOC operations. [confirm schedule/on-call expectations]

Qualifications

• 5+ years of experience in a SOC analyst or threat detection role, including senior or escalation-level investigation work.


• Hands‑on experience with endpoint detection and response (EDR) tools, and practical experience with SIEM or log analysis platforms.


• Working knowledge of identity security and SSO platforms including Microsoft Entra ID and Okta, and understanding of network security fundamentals, firewalls, and web application and API protection (Palo Alto PAN‑OS, Akamai App and API Protector).


• Experience securing a Microsoft 365 environment, including Defender, Exchange Online, and Purview, and familiarity with cloud security posture management tools such as Wiz.


• Familiarity with the MITRE ATT&CK framework and common attacker tactics and techniques, and experience applying threat intelligence, such as IOC enrichment and OSINT research, to support investigations.


• Ability to read and reason about detection logic, such as correlation rules and alert conditions, well enough to identify tuning opportunities.


• Strong written communication skills for incident documentation and analyst to analyst handoffs, and strong interpersonal skills, with the ability to guide non-technical employees through a security incident calmly, clearly, and without judgment.


• Ability to work hybrid out of the Shelton, CT office (4 days in office, 1 day remote).

Preferred Qualifications

• Experience with additional tools in a modern security stack, such as email security, asset and exposure management, microsegmentation, web application firewalls, and security awareness and phishing simulation platforms, as well as threat intelligence platforms or feeds to support proactive detection and campaign correlation.


• Industry certifications such as GCIH, GCFA, GCTI, CompTIA Security+/CySA+, or CEH.


• Basic scripting or automation experience in Python or PowerShell to support detection tuning.


• Prior experience informally mentoring or training junior analysts.


• Experience with ServiceNow or similar case and incident management tooling.

Growth Path

• This role offers a strong foundation for growth within threat detection, with opportunities over time to take on more advanced investigation work, detection engineering exposure, and increased technical responsibility

What do we offer?

• Insurance Plans (medical, dental


• Pension/401K/RSP (country specific)


• Competitive Bonus


• Mobility Allowance


• Tuition Reimbursement


• Company Holidays


• Volunteering time


• And More...

Compensation

The base pay range for this role is $102,700 - $128,400. Pay within this range will be determined in good faith based On Job-related Factors, Which May Include Skills, Experience, education/training, location, and internal equity.