Senior SOC Analyst- Tuesday- Saturday

BNY Mellon•Pittsburgh, PA

About The Position

BNY is seeking a Senior SOC Analyst to join its Security Operations Center team. The role can be based in Pittsburgh, Pennsylvania, and is scheduled Tuesday through Saturday, 8:00 AM–4:00 PM Eastern Time, to support operational coverage. Occasional flexibility may be required during major incidents or planned exercises. The analyst leads security alert triage and investigations, coordinates incident response, and drives root cause analysis, scoping, containment, eradication, and recovery. The role uses security telemetry across SIEM, EDR, IDS/IPS, firewall, cloud, and identity platforms to identify true positives and reduce false positives. It also develops and maintains SOC playbooks, runbooks, and detection logic aligned to MITRE ATT&CK; mentors junior analysts; and partners with Threat Intelligence and Engineering teams to enrich investigations, hunt for indicators of compromise, tune detections, improve log fidelity, and strengthen preventive controls. The role produces incident reports and executive summaries, contributes to metrics and trend analysis, supports purple team exercises and post-incident reviews, and maintains audit-ready investigation documentation in accordance with regulatory and security policies. BNY describes itself as a global financial services company and offers competitive compensation, benefits, wellbeing programs, flexible global resources, and generous paid leaves, including paid volunteer time.

Requirements

6–10 years of experience in a SOC, incident response, or threat detection role, including Tier 2/3 investigations.
Bachelor's degree in Information Security, Computer Science, or a related field.
Advanced proficiency with SIEM platforms such as Splunk, QRadar, or Sentinel; EDR platforms such as CrowdStrike or Microsoft Defender; and SOAR platforms.
Strong knowledge of network security, Windows/Linux, identity systems, and common cloud logging sources.
Hands-on experience with the MITRE ATT&CK framework, threat hunting, IOC/IOA development, and detection tuning.
Demonstrated ability to lead complex incidents, coordinate stakeholders, and communicate clearly under time pressure.
Scripting or automation experience, such as Python or PowerShell, for investigation enrichment and workflow improvements.
Familiarity with NIST CSF/800-61, CIS Controls, and common regulatory requirements impacting incident response.
Excellent documentation skills and an evidence-driven approach to investigations.

Nice To Haves

Advanced certifications such as CISSP or CISM are preferred.
Relevant certifications such as GCIA, GCED, GCIH, GCFA, GNFA, CISSP, or CCSP, or equivalent experience.
Experience with ticketing and case management systems such as ServiceNow and knowledge management practices.
Experience with threat intelligence platforms, sandboxing tools, and malware triage.

Responsibilities

Lead triage and investigation of security alerts, escalating and coordinating incident response as needed.
Perform root cause analysis, scope affected assets, and drive containment, eradication, and recovery.
Correlate events across SIEM, EDR, IDS/IPS, firewalls, cloud logs, and identity platforms to identify true positives and reduce false positives.
Develop, refine, and maintain SOC playbooks, runbooks, and detection logic aligned to the MITRE ATT&CK framework.
Mentor junior analysts and provide guidance on investigation techniques, documentation standards, and operational best practices.
Coordinate with Threat Intelligence to enrich investigations, track adversary TTPs, and proactively hunt for indicators of compromise.
Partner with Engineering teams to tune detections, improve log fidelity, and strengthen preventive controls.
Create incident reports and executive summaries, and contribute to metrics and trend analysis.
Support purple team exercises and post-incident reviews to capture lessons learned and drive continuous improvement.
Ensure adherence to regulatory and security policies, and maintain audit-ready documentation for investigations and incidents.