Security Operations Analyst

About the Role

Anduril Industries is seeking a Security Operations Analyst to join the Detection and Response team. This role acts as a critical monitor for Anduril's defense technologies, responsible for responding to adversarial activity and enhancing detection capabilities.

Key Responsibilities

• Triage and respond to alerts/incidents across phishing, endpoints, cloud infrastructure, services, and SaaS applications.
• Build and optimize detection signatures, response playbooks, and automation using detection-as-code principles.
• Act as the frontline of Detection and Response (DNR), fine-tuning alerts to reduce false positives.
• Participate in threat modeling with cross-functional partners to identify weaknesses in Cloud, Mobile, Endpoints, and other environments.
• Organize and conduct threat hunting and data baselines to identify anomalous patterns.
• Participate in an on-call rotation for security event response and incident investigations.
• Proactively collaborate with stakeholders to mature detection and response capabilities, lead incidents, and mentor junior analysts.
• As a Senior SecOps Analyst, serve as an incident commander as necessary.

Requirements & Tech Stack

• Security monitoring, log analysis, and detection engineering within large datasets.
• Experience with endpoint, network, and various application log sources.
• Experience in Python development, contributing to a shared codebase for SOC automation.
• Experience with one or more SIEM languages (SPL, KQL, SQL).
• Experience conducting analysis in a data lake environment.
• Broad practical security knowledge across endpoint, network, identity, application, and cloud infrastructure.
• Knowledge of attacker tactics, techniques, and procedures (TTPs) across Windows, Linux, MacOS, AWS/Azure, etc.
• Strong communication skills and experience collaborating with stakeholders.
• Ability to obtain and hold a U.S. Top Secret security clearance.

Qualifications

• Experience in security monitoring, log analysis, and detection engineering within large data sets across endpoint, network, and a wide variety of application log sources.
• Experience in Python development, specifically contributing to a shared codebase used for automating SOC operations.
• Must have experience with one or more SIEM languages (SPL, KQL, SQL).
• Experience conducting analysis in a data lake environment.
• Broad range of practical security knowledge across the spectrum of endpoint, network, identity, application, and cloud infrastructure.
• Knowledge of attacker tactics, techniques, and procedures (TTPs) across Windows, Linux, MacOS, AWS/Azure, etc.
• Strong communication skills and experience collaborating with internal and external stakeholders.
• Must be able to obtain and hold a U.S. Top Secret security clearance.

Preferred Qualifications

• Experience conducting incident response in the Cloud (AWS, Azure, GCP).
• Digital Forensics and/or reverse engineering experience is a plus.