Lead Analyst - Cyber Security Operations (Remote)

Hyatt Hotels Corporation is hiring a Lead Analyst for Cyber Security Operations. The role provides senior technical expertise, coordinates incident response, investigates alerts, hunts for threats, builds detections, and improves security operations outcomes across the organization.

Responsibilities:

• Respond swiftly to Cyber Security incidents as they are detected, ensuring that attackers are are removed from the environment, and Hyatt’s operations are restored with minimal disruption
• Lead incident response engagements for Cyber Security and Data Privacy incidents speaheading the triage, containment, eradication, recovery, evidence preservation, post-incident reviews, and corrective actions
• Act as subject matter expert in analyzing detections on endpoints, cloud, SaaS & AI
• Perform forensic analysis, timeline reconstruction, identifying telemetry gaps, and detection engineering
• Perform AI/Agentic SOC responsibilities, such as:
• AI-assisted investigations, enrichment, hunting, and documentation
• Working with supervised security agents and semi-autonomous workflows
• Validating AI outputs and identifying hallucinations or missing context
• Measuring AI effectiveness through accuracy, traceability, escalation quality, action success, and time savings
• Identifying gaps in Hyatt detection pipeline and work on building new detections
• Perform proactive threat hunting searches looking for signs of intrusion in both the Hyatt and Hyatt Franchise environments
• Act as senior-most technical resource for the SOC, develop intimate knowledge of the computing environment and use that knowledge to differentiate legitimate from illegitimate behaviors
• Prepare and present updates for senior leadership on cyber defense program performance
• Review past incident response performance with Security Operations team to identify potential program improvements
• Act as the Point of escalation for operations/security issues
• Must be willing to work off-shift hours, as needed, during incidents. Must also be available for on-call rotation
• Demonstrate a commitment to Hyatt core values

Requirements:

• Proven ability to lead and coordinate a team of analysts
• Strong communication skills, including delivering findings and updates to technical and non-technical teams
• Ability to make sound, timely decisions during high-severity or ambiguous incidents
• Ability to manage competing priorities across ticket queues, escalations, and personnel needs
• Strong coaching and mentoring skills to develop L1 and L2 Analysts
• Ability to build and sustain professional relationships across internal and external stakeholder groups
• Meticulous attention to quality, demonstrated through high-quality documentation
• Ability to lead process-improvement initiatives and own runbook/playbook governance
• Ability to remain composed and provide clear direction during critical incidents
• Ability and willingness to operate in a fast-paced, complex corporate environment
• Minimum of five years' experience in the Cyber Security Operations, or Incident Response
• Extensive knowledge of Advanced Persistent Threats (APT) tactics, technics and procedures
• Deep knowledge of the TCP/IP and OSI network stack and its protocols
• Technical skills associated with Crowdstrike CQL, SPL, KQL, SQL, Python, PowerShell & SOAR
• Familiarity with cutting-edge security technologies such as Zero-Trust Network Access, FIDO 2.0, Endpoint & Extended Detection and Response (EDR/XDR), Web Security Gateways (WSG), Email Security Gateways (ESG), Web Application Firewall (WAF), sandboxes, network- and host- based firewalls, Threat Intelligence, Penetration Testing, etc
• Experience working in a high-intensity threat actor environment
• Experience preparing and presenting status updates for executive leadership
• Experience reviewing and updating Cyber Security Incident Response documentation and time reconstruction
• Knowledge of SaaS, Cloud, information systems terminology, controls, and practices
• Strong verbal and written communication and presentation skills
• Ability to effectively interact with different areas and level of the organization, including executive leadership
• Proactive self-starter with ability to work independently and as part of a larger team
• Familiarity with threat hunting and adversary tactics and techniques (i.e., MITRE ATT&CK, Cyber Kill Chain)
• Familiarity with threat response frameworks (i.e., SANS PICERL, NIST SP 800-61)
• Familiarity with cyber and privacy regulatory requirements (i.e., SEC cybersecurity disclosure rules, CCPA/CPRA, GDPR)
• GIAC - Global Certified Incident Handler (GCIH), or any of the equivalent GIAC, ISC2, ISACA, CompTIA or EC-Council certification
• A bachelor's degree or better in Cyber Security, Information Systems, or any other security-related subject is preferred