Senior Security Analyst

Lead•New York, NY

10d•$142,875 - $170,910

About The Position

Lead Bank is seeking a Senior Security Analyst to join its Security Operations team and strengthen detection and response capabilities. The role builds detections, triages alerts, responds to incidents, and proactively hunts threats across cloud infrastructure, security tooling, and data pipelines. The analyst will mentor junior analysts and partner with leadership to advance the bank’s security posture while helping address the regulatory requirements of the banking industry and defend against advanced persistent threats.

Requirements

5+ years of experience in information security or security operations.
Hands-on SIEM experience, including query writing, detection building, and alert tuning.
Strong working knowledge of cloud security concepts and services; AWS preferred, with GCP and Azure also considered.
Proficiency working with logs across endpoint, cloud, network, identity, and application sources.
Understanding of CI/CD pipelines and IaC, such as Terraform and CloudFormation, from a security perspective.
Solid grasp of Windows, macOS, and Linux internals, including processes, persistence mechanisms, and attacker TTPs.
Demonstrated incident response experience, including leading or contributing to investigations.
Familiarity with data normalization, log parsing, and ETL concepts.
Strong written and verbal communication skills.

Nice To Haves

Experience with log routing, transformation, and enrichment.
Hands-on experience with an enterprise EDR/XDR platform and its ecosystem tooling, including SOAR, exposure management, and identity protection.
Experience with network security tools and interpreting proxy or web traffic logs.
Background in a regulated industry, such as financial services or healthcare, with familiarity with NIST CSF, GLBA, or FFIEC.
Scripting or automation experience with Python or Bash for detection engineering and workflow automation, and experience with version-controlled code in GitHub.
Relevant certifications such as CISSP, GCIH, GCIA, GCED, CEH, GDSA, or equivalent.
Detection as Code experience using version-controlled detection content.
Exposure to identity security tooling.

Responsibilities

Build, tune, and maintain SIEM detection rules and alerts, writing queries to identify threats and coverage gaps aligned to MITRE ATT&CK.
Own incident response end-to-end, including containment, eradication, recovery, forensic log analysis, lessons learned, and post-incident reporting.
Monitor and investigate security events across endpoints, AWS cloud, identity, and network telemetry, identifying misconfigurations, anomalous activity, and suspicious behavior.
Assist with security audits and regulatory examinations by providing timely, accurate security documentation and evidence.
Analyze system, application, and network security configurations in partnership with security engineers.
Manage log pipelines, including ingestion, parsing, normalization, and enrichment, to ensure high-fidelity data is available for detection and investigation.
Triage and prioritize vulnerability findings using risk-based frameworks and track remediation SLAs with IT and Engineering.
Collaborate with Engineering on IaC and CI/CD security reviews and contribute to runbooks and playbooks.
Perform all other duties as assigned.