Senior Cyber Defense Operations Analyst

Epic Games • Cary, NC

1d

About The Position

Epic’s Security Operations Center protects its player community, people, infrastructure, and technology. The Senior Cyber Defense Operations Analyst leads security investigations and incident response while helping transform SOC operations through automated, AI-assisted workflows that allow the team to focus on significant threats.

The role leads investigation and response across cloud, corporate, endpoint, identity, and production environments; coordinates incident response with internal partners; manages the detection lifecycle; and works with security engineering to automate recurring analysis. The analyst also applies threat intelligence and vulnerability information to company-wide assessments and response, maintains operational guidance and metrics, and raises standards for investigation quality, documentation, and managed-service partner performance.

Requirements

• At least 5 years of experience in security operations, incident response, or threat detection, including leading investigations end-to-end.
• Deep hands-on experience with SIEM and EDR platforms, such as Splunk, Google SecOps, or CrowdStrike NGSIEM, and the ability to write effective queries and detections.
• Strong understanding of attacker tradecraft and frameworks such as MITRE ATT&CK, with the ability to reconstruct activity from logs and telemetry.
• Experience investigating in cloud environments (AWS and/or GCP), SaaS, and identity platforms.
• Scripting or programming skills, such as Python, and a drive to automate repetitive work.
• Curiosity about AI and emerging technology, and interest in applying them responsibly to security operations.
• Calm, decisive judgment under pressure, with the ability to prioritize competing incidents and communicate clearly to technical and executive audiences.
• Strong written communication and high standards for incident documentation and reporting.
• A self-directed, ownership-driven approach and willingness to challenge established practices.

Nice To Haves

• SOAR experience.

Responsibilities

• Lead triage, investigation, and response for security alerts and incidents across cloud, corporate, endpoint, identity, and production environments.
• Serve as an escalation point and incident lead, coordinating with engineering, legal, privacy, and business partners through containment, remediation, and post-incident review.
• Manage the detection lifecycle by developing, tuning, and retiring detection logic to improve signal-to-noise ratio, reduce alert fatigue, and address emerging threat gaps.
• Identify recurring analyst work and partner with security engineering to automate it, including AI-agent workflows with appropriate validation and human review.
• Translate threat intelligence and emerging vulnerabilities into rapid exposure assessments and actionable company-wide response.
• Develop and maintain playbooks, runbooks, and operational metrics to improve SOC speed, consistency, and scalability.
• Set and elevate standards for investigation quality and case documentation.
• Coach analysts and hold managed-service partners accountable to rigorous SLAs and analytical depth.

Benefits

• Company-paid premiums for the employee and dependents for medical, dental, vision HRA, long-term disability, and life insurance coverage.
• 401(k) with competitive match.
• Mental well-being program through Modern Health, with free therapy and coaching for employees and dependents.
• Company events and company-wide paid breaks.
• Unlimited PTO and sick time.
• Paid sabbatical after 7 years of employment.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed