Security Analyst III

Expedia•Seattle, WA

44d•Hybrid

About The Position

Our Technology Team partners with teams across Expedia Group to create innovative products, services, and tools to deliver high-quality experiences for travelers, partners, and our employees. A singular technology platform powered by data and machine learning provides secure, differentiated, and personalized experiences that drive loyalty and traveler satisfaction. Ensuring shift health and respond to escalations as a part of the follow the sun 24/7 operating model. This role will perform advanced cybersecurity investigations for security event alerts across a numerous technologies and brands from phishing alerts: identity, cloud, EDR, network, UEBA, API, WAF, user and other team reported events. A subject matter expert (SME) by understanding market trends and influencing team practices, demonstrating advanced cybersecurity (vulnerability management, threat hunting, specialization areas like pen testing), advanced networking (MPLS/GRE tunnels, BGP, VPN deployment), advanced system administration (system installation/configuration, virtual infrastructure, production issue troubleshooting), intermediate understanding of application layers (web, backend, streaming apps), and intermediate scripting (complex, clean, well-commented scripts in Python, PowerShell).

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related technical field, or equivalent practical experience in security engineering.
Several years of hands-on experience in security engineering, including building or operating security tooling, services, or platforms within complex, distributed systems.
Proven experience owning the security posture of one or more services or platforms, including responsibility for implementing controls, monitoring, and remediation within that scope.
Strong technical proficiency in at least one programming or scripting language, with experience applying secure coding practices, working with APIs, and understanding data models in modern software architectures.
Familiarity with AI-driven systems, tools, or workflows and applying AI/ML concepts to real world products.

Nice To Haves

Experience leading shifts in a security operations center or CISRT
Demonstrated success leading security initiatives or projects end to end, such as rolling out new security controls, detection capabilities, or automation across multiple teams or services.
Depth in one or more security domains such as application security, infrastructure security, identity and access management, detection engineering, or vulnerability management, with a track record of measurable risk reduction.
Cybersecurity certifications such as SANS or CISSP
Experience applying data-driven approaches to prioritize security work, tune detections, and improve operational excellence, including defining metrics and feedback loops for continuous improvement.

Responsibilities

Perform advanced level of security investigation on the following areas: application security, cloud security, data security, network security, and perimeter security
Analyze security signals, threat intelligence, and vulnerability data to detect, investigate, and remediate security issues, driving long-term risk reduction through automation and scalable solutions.
Provide in-depth knowledge of cyber-attack analysis and cyber kill-chain framework
Gather data and drill down to root cause analysis, ability to recommend effective courses of containment, remediation, and communicate to the various levels in the organization
Suggest improvements to current Security Detection practices and procedures
Flexibility as the position will require shifts to cover 24x7 follow the sun in line with US and APAC operations.
Responsible for responding immediately to security issues ensuring alignment to SLAs and driving resolution and mitigation