Lead Security Operations Analyst

Wursta

About The Position

Wursta is hiring a Lead Security Operations Analyst for its Managed Security Services Operations (MSSP) team, a cross-functional unit supporting multi-tenant cloud environments with a focus on Google Workspace and Google Cloud Platform. The team operates as a Secure AI Augmented SOC, develops security software, and enables go-to-market security services. It emphasizes automation and an AI-driven, Tier-3-led model rather than traditional manual Level 1/Level 2 escalation structures. The role combines operational leadership and security engineering. As the primary Tier-3 response authority and team lead, the analyst oversees threat monitoring, incident response, and SLA delivery across client tenants on Wursta’s MSSP platform. The position also engineers detections and automated workflows, builds integrations and AI agents, and extends the platform using modern AI development tools and APIs. The analyst leads complex event triage and critical incident response, conducts threat hunting and detection engineering, and advises clients while ensuring contractual and regulatory notification requirements are met. On the engineering side, the role develops production-grade code, SOAR playbooks, integrations, and LLM-powered alert enrichment pipelines. The position also aligns monitoring and incident response practices with applicable security frameworks and privacy laws.

Requirements

Experience with at least one SIEM or XDR platform: Splunk, Microsoft Sentinel, Elastic SIEM, CrowdStrike Falcon, SentinelOne, or Palo Alto Cortex XDR.
Experience with at least one network or telemetry tool or data source: Wireshark, Zeek, Suricata, PCAP analysis, Syslog, Windows Event Logs, or CloudTrail/CloudWatch.
Experience with at least one AI or automation tool or technology: Python (Pandas, Requests), REST APIs, Cursor IDE, GitHub Copilot, Claude/OpenAI APIs, LangChain, webhooks, or Docker.
Experience with at least one SOAR or scripting tool: Python, PowerShell, Bash, Demisto/Cortex XSOAR, Shuffle, or Tines.
Experience with threat frameworks or methods including MITRE ATT&CK (Enterprise or Cloud), NIST SP 800-61r2, Cyber Kill Chain, YARA, or Sigma Rules.
Experience with cloud security architectures, IAM, and log architectures in AWS, Azure, or GCP.
At least one of the following certifications: GIAC Certified Incident Handler (GCIH), GIAC Continuous Monitoring & Security Operations (GMON), GIAC Network Forensics Analyst (GNFA), CompTIA CySA+, CompTIA CASP+, or OSCP.

Nice To Haves

Three or more years in a SOC or MSSP environment, including at least two years in a Level 3 or Lead SOC capacity.
Hands-on experience with scripting and API integration to build automated incident response playbooks.
Proficiency with AI-assisted coding tools such as Cursor or Copilot to build, refactor, and deploy automation scripts and lightweight applications.
Expertise in log analysis across endpoint, identity (including Okta and Azure AD), network, and multi-cloud environments.
ISC2 Certified Information Systems Security Professional (CISSP) certification.

Responsibilities

Lead triage, analysis, and prioritization of complex security events across multi-tenant client environments.
Serve as Incident Commander during critical security events, carrying out containment, eradication, and recovery in accordance with NIST SP 800-61r2.
Use the MITRE ATT&CK Framework to map adversary tactics, techniques, and procedures; conduct proactive threat hunting; and write custom correlation rules such as Sigma and YARA.
Ensure incident notifications and responses meet contractual SLAs and regulatory reporting timelines.
Use AI development environments and APIs to write production-grade Python, Node.js, or Go code that extends the MSSP application's backend.
Build integrations, as client needs require, for security telemetry from EDR, DNS security, threat intelligence, spam/phishing, identity management, firewall/IDS, and related tools.
Design and build SOAR orchestration playbooks for dynamic triage, identity enrichment, and automatic tenant isolation.
Implement AI-driven alert summarization and enrichment pipelines using LLM frameworks, threat databases, SIEM data lakes, third-party APIs, REST webhooks, RAG pipelines, and MCP servers.
Optimize detection pipelines with machine learning and AI filters to reduce false-positive alert volume.
Align security monitoring controls with NIST CSF 2.0, ISO/IEC 27001:2022 Control A.8.16, and NIST SP 800-53r5 AU, IR, and SI control families.
Ensure incident response procedures and telemetry collection comply with EU GDPR, Brazil LGPD, and US state privacy laws including CCPA/CPRA.