Senior Cybersecurity Analyst

Travelport•Atlanta, GA

3d•Remote

About The Position

Travelport is seeking an experienced Senior Cybersecurity Analyst to join its Cybersecurity team. The position is responsible for advanced security investigations, threat hunting, digital forensics, insider threat analysis, detection engineering, and continuous improvement of security monitoring and response capabilities. The analyst investigates complex security events across network, endpoint, email, cloud, identity, data security, and user behavior environments, correlating information from multiple sources to determine the scope, timeline, and impact of potential incidents. As a senior team member, this person also serves as a technical mentor and escalation point for other analysts and helps maintain, tune, and improve enterprise security technologies. The role is remote in the US. Travelport offers 25 days of annual leave per annum, a pension contribution, private medical coverage, life assurance, and personal travel insurance.

Requirements

At least 5 years of relevant experience in cybersecurity, security operations, incident response, digital forensics, threat detection, insider threat, or related disciplines.
Strong experience analyzing network, firewall, endpoint, authentication, and other security logs and correlating evidence across multiple data sources.
Demonstrated experience investigating complex cybersecurity incidents and reconstructing incident timelines.
Experience with email security, DLP investigations and tuning, cloud or SaaS security investigations, insider threat, and User and Entity Behavior Analytics (UEBA).
Experience conducting threat hunting and gathering or analyzing threat intelligence.
Working knowledge of digital forensic principles, techniques, and common forensic artifacts.
Strong understanding of cybersecurity controls, defense-in-depth concepts, common attacker techniques, and frameworks such as MITRE ATT&CK.
Experience with enterprise security technologies such as SIEM, EDR/XDR, firewalls, email security, DLP, UEBA, and cloud security platforms.
Understanding of detection and rule engineering, including developing and tuning security rules, alerts, policies, and behavioral detections.
Strong analytical, troubleshooting, documentation, and communication skills, with the ability to independently manage complex investigations.
Demonstrated ability to mentor, coach, and provide technical guidance to other cybersecurity professionals.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline, or equivalent professional experience.

Nice To Haves

Experience with security tool administration, scripting/automation, or security engineering; these capabilities may also be developed on the job.
Experience performing static or dynamic analysis of suspicious files, scripts, documents, or executables.
Relevant industry certifications such as CISSP, GCIH, GCFA, GCIA, GNFA, GREM, CySA+, or equivalent; preferred but not required.

Responsibilities

Lead complex cybersecurity investigations across network, endpoint, email, cloud, identity, data security, and user behavior environments.
Analyze network, firewall, authentication, endpoint, and other security telemetry; correlate evidence and reconstruct incident timelines to determine attack vectors, scope, impact, and root cause.
Investigate email-based threats, including phishing, business email compromise, malicious attachments, and account compromise.
Investigate DLP alerts and potential data loss events, and tune policies, rules, thresholds, and detection logic.
Conduct insider threat investigations using DLP, UEBA, endpoint, identity, and other telemetry; develop and tune behavioral rules, indicators, and risk thresholds.
Investigate suspicious activity in cloud and SaaS environments.
Conduct proactive threat hunting and gather and analyze threat intelligence related to emerging threats and attacker tactics, techniques, and procedures.
Perform digital forensic analysis in support of cybersecurity incidents and investigations.
Develop and tune security detections, correlation rules, alerts, policies, and monitoring logic.
Assist with configuration, maintenance, troubleshooting, and optimization of cybersecurity technologies, and identify security control gaps.
Document investigative findings, evidence, timelines, and remediation recommendations.
Serve as a technical escalation point and mentor other analysts in investigations, incident response, threat hunting, log analysis, insider threat, and security technologies.
Develop and share technical documentation, investigation techniques, and lessons learned to improve team capabilities.