Sr Cyber Defense Ops Spec

We are seeking a skilled and proactive Level 2 Cybersecurity Analyst to join our Cyber Defense Operations team. This role is responsible for investigating and responding to security incidents, performing advanced threat analysis, and supporting the continuous improvement of detection and response capabilities. You’ll work closely with junior analysts, threat intelligence, and incident response teams to ensure timely detection and mitigation of security threats across Citizens Bank’s enterprise environment.

Key Responsibilities

• Investigate escalated security alerts and incidents from Level 1 analysts.
• Perform root cause analysis and impact assessments of security events.
• Conduct threat hunting and anomaly detection across enterprise systems.
• Collaborate with incident response teams to contain and remediate threats.
• Correlate threat intelligence with internal telemetry to identify emerging threats and attack patterns.
• Assist in the creation of use cases and offer recommendations for tuning detection rules in SIEM and other monitoring tools.
• Recommend improvements to incident response playbooks and runbooks.
• Provide mentorship and guidance to Level 1 analysts.
• Participate in post-incident reviews and contribute to lessons learned.
• Represent Cyber Defense in cross-functional security and risk initiatives.

Required Knowledge Areas

• Deep understanding of network and endpoint security concepts.
• Knowledge of threat actor tactics, techniques, and procedures (TTPs).
• Familiarity with the MITRE ATT&CK framework and threat intelligence platforms.
• Knowledge of regulatory and compliance frameworks (e.g., NIST, ISO, PCI-DSS).

Required Skills

• Proficient in log analysis, packet capture review, and malware analysis.
• Strong analytical and problem-solving skills.
• Experience with scripting or automation (Python, PowerShell, Bash).
• Effective oral and written communication skills for both technical and non-technical audiences.
• Ability to work independently and collaboratively in a high-pressure environment.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, or a related field, or equivalent experience.
• 2–5 years of experience in cybersecurity operations or incident response.
• Security certifications such as CySA+, GCIH, GCIA, CEH, or equivalent preferred.
• Experience with SIEM platforms (e.g., Splunk, Sentinel, QRadar) and EDR tools (e.g., CrowdStrike, Microsoft Defender).
• Willingness to participate in a rotating on-call schedule or extended hours during critical incidents.

Preferred Experience

• Hands-on experience with:
• SIEM Tools: Splunk, ArcSight, Sentinel, QRadar
• EDR/XDR: CrowdStrike, Microsoft Defender, SentinelOne
• Network Security: Palo Alto, Cisco, Check Point, FirePower
• Data Protection: Symantec DLP, Triton, Guardium
• Threat Intelligence & SOAR Platforms
• Cloud Security Monitoring: AWS, Azure, or GCP environments

Hours Work and Schedule

• Hours per Week: 7am - 5pm
• Work Schedule: Monday - Thursday 

Equal Employment Opportunity

Citizens, its parent, subsidiaries, and related companies (Citizens) provide equal employment and advancement opportunities to all colleagues and applicants for employment without regard to age, ancestry, color, citizenship, physical or mental disability, perceived disability or history or record of a disability, ethnicity, gender, gender identity or expression, genetic information, genetic characteristic, marital or domestic partner status, victim of domestic violence, family status/parenthood, medical condition, military or veteran status, national origin, pregnancy/childbirth/lactation, colleague’s or a dependent’s reproductive health decision making, race, religion, sex, sexual orientation, or any other category protected by federal, state and/or local laws. At Citizens, we are committed to fostering an inclusive culture that enables all colleagues to bring their best selves to work every day and everyone is expected to be treated with respect and professionalism. Employment decisions are based solely on merit, qualifications, performance and capability.

Equal Employment and Opportunity Employer

Job Applicant Data Privacy Policy

Background Check

Any offer of employment is conditioned upon the candidate successfully passing a background check, which may include initial credit, motor vehicle record, public record, prior employment verification, and criminal background checks. Results of the background check are individually reviewed based upon legal requirements imposed by our regulators and with consideration of the nature and gravity of the background history and the job offered. Any offer of employment will include further information.