Senior Security Operations Analyst

Nasuni is seeking a Senior Security Operations Analyst to strengthen enterprise security operations across cloud, identity, endpoint, email, and collaboration environments. The role independently leads complex investigations, improves detection quality and SOC processes, manages operational metrics, coordinates remediation, and mentors other analysts.

Responsibilities:

• Lead advanced investigations across endpoint, identity, cloud, email, SaaS, and network telemetry; determine scope, impact, root cause, containment, and follow-up actions
• Operate and improve an enterprise security stack that includes Sumo Logic Cloud SIEM, Wiz, Rapid7 InsightIDR and InsightVM/Exposure Command, and Darktrace / EMAIL, or comparable platforms
• Build and tune queries, correlation rules, detections, enrichments, threat hunts, dashboards, case workflows, and SOAR playbooks; improve MITRE ATT&CK coverage and reduce false positives
• Own the accuracy, reporting, and continuous improvement of SOC measures such as MTTD, MTTC, and MTTR, along with alert fidelity, aged backlog, escalation quality, and SLA attainment
• Improve SOC runbooks, incident procedures, severity criteria, escalation paths, analyst handoffs, case documentation, and post-incident review practices
• Partner with system owners to prioritize vulnerability and cloud-risk remediation using business context, exploitability, asset criticality, and compensating controls
• Use Nasuni-approved AI capabilities to accelerate log analysis, alert enrichment, case summarization, query development, and playbook drafting while validating outputs and protecting sensitive data
• Participate in the global on-call rotation and mentor analysts through case reviews, threat scenarios, and practical feedback

Requirements:

• 5+ years of security experience, including 3+ years in an enterprise SOC, incident response, or detection-and-response function
• Demonstrated ownership of complex or high-severity investigations from triage through containment and remediation coordination
• Strong hands-on SIEM experience, including search, correlation, rule tuning, log onboarding, dashboards, and investigation workflows
• Experience improving SOC processes and using operational metrics to identify bottlenecks and validate improvement
• Working knowledge across cloud security, EDR, identity, vulnerability management, and email security
• Clear written and verbal communication with technical and business stakeholders
• Measurably improved MTTD, MTTC, MTTR, false-positive rates, backlog health, or response SLA performance
• Led post-incident reviews, established reusable SOC operating practices, or coached other analysts
• Typically 5–9 years of relevant experience, with evidence of enterprise-scale ownership weighted more heavily than tenure alone
• Direct hands-on experience with two or more of Sumo Logic, Wiz, Rapid7 InsightIDR/InsightVM, and Darktrace / EMAIL
• Detection engineering, SOAR, threat hunting, PowerShell or Python, multi-cloud monitoring, or MDR coordination experience
• Responsible use of AI-assisted security or observability workflows with clear validation and data-handling controls