Lead Analyst – Cyber Incident Response

Raymond James•Saint Petersburg, FL

5d•Hybrid

About The Position

The financial services industry is constantly under attack by sophisticated cyber adversaries that range from nation-states to criminals. In response, the Raymond James Cyber Threat Center (CTC) is charged with ensuring all equities are secure against all tiers of adversaries. We are the central hub for Computer Network Operations and are on the front lines of security incident response, threat hunting, and intelligence. You'll be working with emerging technologies to solve challenging security problems in a fast-paced and continually evolving environment while helping steer the direction and evolution of the team. This highly visible team within the organization evaluates threats to the environment and dynamically adjusts to the ever-changing threat landscape by applying practical security knowledge to developing new detective measures to protect the firm. The Lead Analyst – Cyber Incident Response, is a key member of the Cyber Threat Center (CTC) who serves as both a lead incident response leader and a technical engineering lead responsible for driving intelligent automation and AI-enabled cybersecurity operations. The position combines deep expertise in cyber incident response, threat hunting, malware analysis, and forensic investigations with advanced engineering capabilities in SOAR automation, AI/ML integration, orchestration platforms, and security workflow development. This role leads security operations initiatives, mentors analysts, develops advanced automation and AI-enabled response capabilities, and operationalizes intelligent security solutions that improve threat detection, triage, containment, and remediation across the enterprise. The position partners with incident response, threat detection, security engineering, and technology teams to design scalable workflows, streamline investigations, reduce manual effort, and improve response consistency.

Requirements

Bachelor’s degree in Computer Science, Computer Engineering, Management Information Systems, Cybersecurity, or a related field, and 5–8 years of relevant experience in Information Security, Cybersecurity Operations and Incident Response.
Minimum of 4 years of hands-on incident response experience, including triage, investigation, containment, eradication, recovery, and post-incident analysis.
Minimum of 2 years of programming or scripting experience using at least one modern language such as Python, JavaScript, PowerShell, or Rust, with a focus on automation, data enrichment, and security operations workflows.
Experience designing, developing, and maintaining automation workflows that support incident response, alert triage, threat enrichment, case management, and analyst productivity.
Experience with API development, integration, and orchestration across security tools, cloud platforms, ticketing systems, and enterprise data sources.
Familiarity with agentic AI workflows, AI-assisted security operations, or the application of GenAI/LLMs to automate investigation, summarization, enrichment, decision support, and response actions.
Experience with Security Orchestration, Automation, and Response platforms, case management tools, or similar technologies used to streamline incident response processes.
Strong understanding of incident response frameworks, common attack techniques, security telemetry, and investigation workflows, including endpoint, network, identity, cloud, and email-based incidents.
Experience working with SIEM, EDR, SOAR, threat intelligence, log management, and cloud security platforms.
Ability to translate complex incident response processes into repeatable, scalable automation requirements, playbooks, and technical solutions.
Strong analytical, troubleshooting, and problem-solving skills with the ability to work independently and lead efforts during high-priority security incidents.
Excellent written and verbal communication skills, including the ability to document technical findings, explain automation logic, and communicate incident details to technical and non-technical stakeholders.
Ability to mentor analysts, promote automation adoption, and identify opportunities to improve incident response speed, consistency, and quality.

Nice To Haves

One or more of the following certifications preferred: CISSP, SANS GCIH (Incident Handler), SANS GCIA (Intrusion Analyst), SANS GCFE (Forensic Analyst), Offensive Security Certified Professional (OSCP), Certified Ethical Hacker (CEH)

Responsibilities

Serves as a primary member of the Cyber Threat Center (CTC) who handles security events and incidents in a fast-paced environment.
Acts as an Incident Handler capable of managing severity 1 and severity 2 security incidents within the defined Computer Security Incident Response process.
Design, build, and maintain scalable automation solutions, including AI-enabled workflows to improve threat detection, triage, and incident response efficiency.
Develops new forensic detective and investigative capabilities using current and emerging technical solutions.
Shares in a weekly on-call rotation and acts as an escalation point for managed security services and Raymond James associates.
Leverage programming and data science techniques to develop, operationalize, and optimize machine learning models and data-driven security use cases.
Develop and implement advanced data correlation, enrichment, and processing strategies leveraging automation, data science, AI/ML, and LLM capabilities for threat hunting and incident response analysis.
Apply AI engineering principles within security operations to design, deploy, and maintain intelligent detection and response capabilities.
Design and execute automated and intelligent response actions to validate, contain, eradicate, and remediate security incidents.
Prototype, evaluate, and deploy emerging AI-driven technologies to enhance detection accuracy, reduce false positives, and accelerate response times.
Ensure Security Operations applications, automation pipelines, and incident ingestion processes remain healthy, resilient, and performant.
Drive continuous improvement by identifying gaps, recommending enhancements, and implementing innovative SOAR and AI-driven solutions.
Collaborate with incident response, threat intelligence, and threat hunting teams to strengthen detection and response capabilities.