Top Cybersecurity Jobs

Manages a regional Security Operations Center supporting 24/7 incident investigation and response. Responsibilities include optimizing processes, workflows, playbooks, shift coverage, quality assurance, analyst development, training, cross-functional coordination, and operational metrics. The role provides technical leadership, supports detection and response initiatives, partners with Product and Support teams, operationalizes new services, and represents the organization in public speaking engagements.

Investigate and respond to cybersecurity alerts, intrusions, malware, and compromised cloud tenants. Analyze EDR/SIEM telemetry, logs, forensic artifacts, and network activity; perform malware analysis; develop and tune detections; provide remediation guidance; and support customer escalations. The analyst will collaborate with Product and Engineering, contribute to incident response and threat hunting, and communicate findings clearly to varied audiences.

Manage a global 24/7 Security Operations Center, including analyst leadership, shift coverage, operational processes, quality assurance, training, and career development. Improve workflows, playbooks, and service-level performance while collaborating with Product, Support, Tactical Response, Threat Hunting, and Detection Engineering teams. Lead initiatives, track security operations objectives, operationalize new services, and communicate technical concepts to internal stakeholders and external audiences.

Monitor, triage, investigate, and respond to cybersecurity alerts and intrusions. Analyze EDR telemetry, logs, forensic artifacts, malware, and Microsoft 365 activity; determine root causes and recommend remediation. Support threat-related escalations, contribute to detection engineering and tuning, and collaborate across teams. The role requires familiarity with endpoint attack surfaces, threat actor techniques, Windows and domain administration, networking, web security, and basic malware analysis.

Research and simulate emerging phishing and social-engineering attacks for a security awareness training product. Build realistic phishing emails and landing pages using web technologies, analyze reported incidents and attack trends, automate content generation with AI coding tools, and expand training globally. The role also creates educational content, reports threat insights, supports outreach, and collaborates with product leadership to improve phishing defense outcomes.

Lead the architecture and development of a production Agentic SOC that uses LLM-based agents to investigate security signals, gather evidence, make defensible decisions, and support SOC analysts. Own agent behavior, tool use, evaluation, guardrails, tenant isolation, auditability, reliability, and autonomous decision-making. Collaborate with analysts, detection engineers, product, and engineering teams while providing technical leadership and mentoring. Build scalable backend systems using distributed workflows, queues, cloud infrastructure, and data stores.

Develop and maintain high-fidelity detections across identity, endpoint, SIEM, and operating-system environments. Conduct hypothesis-driven threat hunts across large-scale telemetry, translate threat intelligence and investigations into detection rules, tune detection efficacy, investigate ambiguous attacker activity, and escalate likely intrusions with clear incident reports. The role also involves building hunting queries and dashboards, contributing to security content, and validating AI-assisted analysis and detection workflows.

Leads North American detection engineering and threat hunting operations, translating global strategy into regional roadmaps, scaling distributed technical teams, managing hiring and budgets, coordinating with Product and Engineering, and directing incident response during major security events. The role owns detection efficacy, performance metrics, cross-region collaboration, and the hunt-to-detect feedback loop while mentoring senior practitioners and advocating for security tooling and telemetry.

Lead internal security incident response as the primary SOC escalation point. Responsibilities include incident triage and validation, tabletop and purple-team exercises, telemetry optimization, threat coverage improvements, post-incident reviews, remediation tracking, stakeholder reporting, and maintaining response playbooks and standards. The role partners with engineering, product security, detection engineering, and offensive security teams to improve organizational resilience.

Own the vision, roadmap, and delivery of internal SOC tooling, including analyst UX, response workflows, investigation models, and automation. Partner with SOC leadership, engineering, design, and product teams to transform manual processes into scalable workflows. Define requirements, interfaces, operational metrics, and investment cases while improving analyst throughput, time-to-close, and delivery repeatability. The role requires deep SOC operations knowledge, cybersecurity product management experience, and expertise building operator-facing platforms and AI-enabled products.