Lead Security Analyst
Overview:
In this role, you lead the design, development, and maintenance of automated security workflows to streamline incident response. You'll collaborate with security analysts and engineers to turn operational needs into reliable automation, guided by responsible AI and production-ready playbooks. You drive measurable improvements in alert handling, triage, and remediation across SIEM, EDR, threat intel, and ticketing ecosystems. This position offers growth at the intersection of security operations and AI-enabled automation within a trusted, privacy-focused culture. Compensation / Benefitsbenefits packagevariable and commission compensation opportunitiesvacation entitlementpaid time offdisability and wellness programsflexible work arrangements
Responsibilities:
- Design, develop, and maintain automated security playbooks for alert triage, enrichment, investigation, response, notification, and ticketing
- Build custom integrations and data transformation routines using Python and Jinja
- Integrate SIEM, EDR, threat intelligence, firewall, case management, and ticketing platforms via REST APIs and connectors
- Monitor, troubleshoot, and optimize automation workflows for reliability and performance
- Collaborate with analysts and operations to automate manual security processes
- Debug code, enhance workflow execution, and maintain automation logic for production readiness
- Support responsible adoption of AI-enabled automation for triage, recommendations, and human-reviewed actions
- Drive automation best practices including testing, runbooks, change management, and cross-team collaboration
- Contribute to SOC, incident response, threat intelligence, detection engineering, and vulnerability management workflows
Key requirements:
- Strong hands-on experience developing security automation using Python, Jinja, REST APIs, and structured data formats
- Experience integrating security orchestration, monitoring, endpoint security, network security, threat intelligence, ticketing, and case management platforms
- Solid understanding of TCP/IP, DNS, HTTPS, and common network protocols used in security investigations
- Proven ability to troubleshoot complex automation issues, debug code, optimize workflows, and improve operational efficiency
- Experience documenting workflows, maintaining version-controlled logic, testing playbooks, and supporting reliable production operations
- Strong collaboration and communication skills, with ability to translate requirements into practical automation solutions
- Proactive mindset focused on continuous improvement, reducing manual response efforts, and enhancing incident response consistency
- Bachelor in Cybersecurity or equivalent experience with 5+ years in cybersecurity/automation/operations; preferred Security+, CISSP, GCIH, GCIA or related credentialscollaborationclear communicationproactive mindset
- PythonJinjaREST APIs