Security Operations Analyst

About the Role

Anduril Industries is seeking a Security Operations Analyst to join the Detection and Response team. This role serves as a critical part of monitoring and responding to adversarial activity, contributing to the development of detection capabilities, and analyzing security data.

Key Responsibilities

• Triage and respond to alerts and incidents across phishing, endpoints, cloud infrastructure and services, and SaaS applications.
• Build and optimize tailored detection signatures, response playbooks, and response automation using detection-as-code principles.
• Lead the feedback loop for detections to fine-tune alerts and reduce false positives.
• Participate in threat modeling scenarios with cross-functional partners to identify weaknesses across Cloud, Mobile, Endpoints, and other environments, incorporating findings into security controls and/or detection signatures.
• Organize and conduct threat hunting and data baselines to identify anomalous patterns in data.
• Participate in an on-call rotation for responding to security events and conducting incident response investigations.
• Effectively communicate findings to key stakeholders.
• Proactively collaborate with a wide range of stakeholders, guiding detection and response maturity, leading incidents and large-scale data baselines.
• Mentor and guide junior analysts.
• As a Senior SecOps Analyst, serve as an incident commander.

Requirements & Tech Stack

• Experience in security monitoring, log analysis, and detection engineering within large data sets across endpoint, network, and a wide variety of application log sources.
• Experience in Python development, specifically contributing to a shared codebase used for automating SOC operations.
• Experience with one or more SIEM languages: SPL, KQL, SQL.
• Experience conducting analysis in a data lake environment.
• Broad range of practical security knowledge across endpoint, network, identity, application, and cloud infrastructure.
• Knowledge of attacker tactics, techniques, and procedures (TTPs) across Windows, Linux, MacOS, AWS/Azure, etc.
• Strong communication skills and experience collaborating with internal and external stakeholders.
• Must be able to obtain and hold a U.S. Top Secret security clearance.

Preferred Qualifications

• Experience conducting incident response in the Cloud (AWS, Azure, GCP).
• Digital Forensics and/or reverse engineering experience.