Sr. Threat Detection Analyst

Subway•Shelton, CT

21h•Hybrid

About The Position

The Sr. Threat Detection Analyst is a senior, escalation-level individual contributor on the SOC team. The analyst investigates alerts escalated by junior analysts, combines threat intelligence with hands-on analysis to validate and contextualize findings, determines incident scope and business impact, and drives incidents toward resolution or a documented handoff for complex cases. The role has no direct reports, but includes mentoring and technical guidance for junior analysts. The analyst investigates threats across Subway’s Microsoft 365 environment and cloud security tools, develops attack timelines, identifies indicators of compromise, and contributes to incident-response playbooks and detection tuning. The role also involves communicating with employees and business stakeholders during investigations, documenting findings and remediation, supporting audit and compliance readiness, and participating in on-call or rotational shift coverage as needed. The position is hybrid and requires working from the Shelton, Connecticut office four days per week and remotely one day per week. The stated base pay range is $102,700–$128,400.

Requirements

At least 5 years of experience in a SOC analyst or threat detection role, including senior or escalation-level investigation work.
Hands-on experience with endpoint detection and response (EDR) tools and practical experience with SIEM or log analysis platforms.
Working knowledge of identity security and SSO platforms, including Microsoft Entra ID and Okta.
Understanding of network security fundamentals, firewalls, and web application and API protection, including Palo Alto PAN-OS and Akamai App and API Protector.
Experience securing a Microsoft 365 environment, including Defender, Exchange Online, and Purview.
Familiarity with cloud security posture management tools such as Wiz.
Familiarity with MITRE ATT&CK and common attacker tactics and techniques.
Experience applying threat intelligence, including IOC enrichment and OSINT research, to support investigations.
Ability to read and reason about detection logic, such as correlation rules and alert conditions, to identify tuning opportunities.
Strong written communication skills for incident documentation and analyst-to-analyst handoffs.
Strong interpersonal skills and the ability to guide non-technical employees through a security incident calmly, clearly, and without judgment.
Ability to work hybrid from the Shelton, Connecticut office four days per week and remotely one day per week.

Nice To Haves

Experience with additional modern security-stack tools, such as email security, asset and exposure management, microsegmentation, web application firewalls, and security awareness and phishing simulation platforms.
Experience with threat intelligence platforms or feeds for proactive detection and campaign correlation.
Industry certifications such as GCIH, GCFA, GCTI, CompTIA Security+/CySA+, or CEH.
Basic Python or PowerShell scripting or automation experience to support detection tuning.
Prior experience informally mentoring or training junior analysts.
Experience with ServiceNow or similar case and incident management tooling.

Responsibilities

Serve as a senior escalation point for alerts triaged by junior analysts, correlating signals across security tools to validate alerts and determine incident scope and business impact.
Build attack timelines and identify indicators of compromise using CrowdStrike Falcon Next-Gen SIEM, threat intelligence, IOCs, threat actor tactics and techniques, and OSINT research.
Investigate and respond to threats across Microsoft 365, including Microsoft Defender, Exchange Online, and Purview compliance and DLP alerts.
Triage and act on cloud security findings from Wiz, including active threats, misconfigurations, vulnerabilities, and exposure risks.
Execute and continuously refine incident response playbooks covering account takeover, credential stuffing, phishing, insider threats, data exfiltration, endpoint and EDR detections, network and firewall activity, command and control, identity and SSO anomalies, DDoS, botnet and web attacks, security coverage and hygiene gaps, and ransomware.
Escalate confirmed, high-severity, or technically complex incidents with clear and complete handoff documentation.
Evaluate detection rules and alerts to identify tuning opportunities and contribute recommendations that reduce noise and improve detection fidelity.
Improve playbooks based on patterns and trends observed during investigations.
Mentor and coach junior analysts on triage methodology, investigation techniques, and tool usage.
Communicate investigation findings and next steps clearly and calmly to employees and business stakeholders, including in stressful or sensitive situations.
Document investigation steps, findings, and remediation actions in the case management system in accordance with SOC procedures and audit and compliance documentation standards.
Participate in on-call or rotational shift coverage as needed to support SOC operations.