Senior SOC Analyst – Vehicle & API Security

Upstream Security•Michigan, USA, MI

11d•Hybrid

About The Position

Upstream Security is hiring a Senior SOC Analyst to join its managed cybersecurity services team. The analyst will investigate and respond to cybersecurity incidents involving connected vehicles, mobility applications, backend services, and APIs. As a senior team member, the analyst will serve as a security focal point for customers, lead complex investigations, improve detection capabilities, and help deploy and maintain agentic AI workflows used in SOC operations. This is a full-time, hybrid position based in Michigan, USA.

Requirements

At least 3 years of experience in SOC operations, incident response, threat hunting, or security investigations.
Previous customer-facing analyst experience, preferably within an MSSP, consulting, or professional services context; English is preferred.
Strong practical understanding of APIs, including REST, authentication, authorization, OAuth, and JWT.
Hands-on API security experience with technologies such as WAFs, API gateways, API security platforms, SIEM, Burp Suite, or similar tools.
Experience investigating common API threats, including account abuse, authorization flaws, injection, data exposure, and business-logic attacks.
Experience with SIEM, SOAR, XDR, security automation, and large-scale data analysis.
Experience deploying or maintaining automation, AI-assisted, or agentic AI workflows.
Scripting experience, preferably with Python or SQL.
Ability to lead complex investigations and operate effectively in high-pressure environments.

Nice To Haves

Experience in automotive, mobility, IoT, cloud security, mobile application security, or managed security services.

Responsibilities

Monitor, investigate, and respond to vehicle and API security alerts.
Lead complex investigations, assess impact, identify root causes, and provide actionable mitigation recommendations.
Analyze suspicious vehicle behavior, API activity, authentication events, and mobility-related telemetry.
Investigate API threats, including authorization abuse, credential attacks, injection, data exposure, automation, and business-logic abuse.
Deploy, configure, test, and maintain agentic AI workflows supporting alert triage, investigations, threat hunting, reporting, and response.
Monitor the accuracy, reliability, and operational performance of AI-driven workflows and improve their prompts, tools, guardrails, and decision logic.
Conduct proactive threat hunting and OSINT investigations to identify emerging threats and attack patterns.
Develop and maintain investigation playbooks, operational procedures, and response processes.
Tune detection logic, behavioral profiles, and machine-learning models to improve detection quality and reduce false positives.
Produce investigation reports, incident updates, dashboards, and executive-level summaries.
Act as a trusted security advisor to customers during investigations, workshops, and business reviews.
Mentor analysts and promote consistent investigation quality across the SOC.
Track operational performance against SLAs, quality standards, and SOC KPIs.
Collaborate with threat intelligence, research, product, engineering, and customer-facing teams to improve Upstream’s security capabilities.