Threat Detection and Response Analyst

Saige Partners•San Jose, CA

About The Position

Join us at Saige Partners, where we aim to shape your future and be the solution that propels your career forward! For more information, feel free to reach out to Christine Gonzalez via email at [email protected] , or schedule a meeting directly at https://calendly.com/bcampbell-saigepartners to discover more about this exciting role! Position: Threat Detection and Response Analyst (Contract Role) What You’ll Do Monitor, triage, and investigate security alerts and events across enterprise environments using Splunk SIEM, EDR, network, cloud, and endpoint telemetry. Analyze security event logs from diverse sources including firewalls, IDS/IPS, endpoint protection platforms, operating systems, and cloud services to identify malicious activity. Perform initial and advanced analysis of security incidents, determine scope and impact, identify root cause, and recommend containment and remediation actions. Escalate confirmed incidents appropriately and support end-to-end incident response activities, including coordination with IT, cloud, and infrastructure teams. Design, validate, tune, and optimize detection logic, correlation rules, dashboards, and alerting use cases to improve signal-to-noise ratio and operational efficiency. Ensure log ingestion health, completeness, and fidelity across critical infrastructure and enterprise systems. Support onboarding and integration of new log sources into the Splunk environment, including validation of parsing, normalization, and field extraction. Conduct proactive threat hunting using SIEM, EDR, CASB, and cloud telemetry to identify advanced or evasive threats that bypass automated detections. Monitor network traffic and behavioral indicators to detect anomalies, lateral movement, privilege abuse, and data exfiltration attempts. Prioritize vulnerabilities and remediation efforts based on threat context, asset criticality, and business impact. Partner with IT and infrastructure teams to track remediation, validate fixes, and reduce recurring risk. Continuously improve detection coverage, response playbooks, and SOC workflows based on incident learnings and emerging threats. Maintain accurate documentation for detection use cases, log flows, triage procedures, threat models, and operational standards. Collaborate closely with cross-functional security and IT teams to ensure rapid, effective response to security incidents.. Requirements Bachelor’s degree in Computer Science, Information Security, or a related field; Master’s degree preferred. 5+ years of experience in a SOC, threat detection, or incident response role with hands-on experience Strong expertise in threat analysis, incident investigation, and response workflows. Solid understanding of enterprise log sources including Windows/Linux servers, network devices, endpoints, and cloud platforms. Experience triaging and investigating alerts in complex, multi-platform environments. Familiarity with cloud environments such as AWS, Azure, or similar, including cloud-native logging and security services. Knowledge of detection engineering, correlation logic, MITRE ATT&CK techniques, and SOC operational best practices. Ability to communicate findings clearly and collaborate effectively across technical and non-technical teams. Comfortable operating in diverse, global environments with strong adaptability and professionalism. Curious, resilient, and data-driven mindset with a passion for continuous learning and threat research. Relevant certifications such as CompTIA Security+, CISSP, Pentest+, or similar are a plus. Join our team and help shape the future of enterprise storage technology. Your work will have a global impact, powering performance-driven solutions for the world’s most demanding applications. About Saige Partners: Recognized as one of the fastest-growing technology and talent companies in the Midwest, Saige Partners believes in nurturing individuals with a zeal for success. We're committed to building careers, not just jobs. Our belief in our employees as our most valuable asset is reflected in our comprehensive benefits package and convenient weekly payment solutions, promoting health and a positive work-life balance. Explore this opportunity and more at https://careers.saigepartners.com/ .

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field
5+ years of experience in a SOC, threat detection, or incident response role with hands-on experience
Strong expertise in threat analysis, incident investigation, and response workflows.
Solid understanding of enterprise log sources including Windows/Linux servers, network devices, endpoints, and cloud platforms.
Experience triaging and investigating alerts in complex, multi-platform environments.
Familiarity with cloud environments such as AWS, Azure, or similar, including cloud-native logging and security services.
Knowledge of detection engineering, correlation logic, MITRE ATT&CK techniques, and SOC operational best practices.
Ability to communicate findings clearly and collaborate effectively across technical and non-technical teams.
Comfortable operating in diverse, global environments with strong adaptability and professionalism.
Curious, resilient, and data-driven mindset with a passion for continuous learning and threat research.

Nice To Haves

Master’s degree preferred.
Relevant certifications such as CompTIA Security+, CISSP, Pentest+, or similar are a plus.

Responsibilities

Monitor, triage, and investigate security alerts and events across enterprise environments using Splunk SIEM, EDR, network, cloud, and endpoint telemetry.
Analyze security event logs from diverse sources including firewalls, IDS/IPS, endpoint protection platforms, operating systems, and cloud services to identify malicious activity.
Perform initial and advanced analysis of security incidents, determine scope and impact, identify root cause, and recommend containment and remediation actions.
Escalate confirmed incidents appropriately and support end-to-end incident response activities, including coordination with IT, cloud, and infrastructure teams.
Design, validate, tune, and optimize detection logic, correlation rules, dashboards, and alerting use cases to improve signal-to-noise ratio and operational efficiency.
Ensure log ingestion health, completeness, and fidelity across critical infrastructure and enterprise systems.
Support onboarding and integration of new log sources into the Splunk environment, including validation of parsing, normalization, and field extraction.
Conduct proactive threat hunting using SIEM, EDR, CASB, and cloud telemetry to identify advanced or evasive threats that bypass automated detections.
Monitor network traffic and behavioral indicators to detect anomalies, lateral movement, privilege abuse, and data exfiltration attempts.
Prioritize vulnerabilities and remediation efforts based on threat context, asset criticality, and business impact.
Partner with IT and infrastructure teams to track remediation, validate fixes, and reduce recurring risk.
Continuously improve detection coverage, response playbooks, and SOC workflows based on incident learnings and emerging threats.
Maintain accurate documentation for detection use cases, log flows, triage procedures, threat models, and operational standards.
Collaborate closely with cross-functional security and IT teams to ensure rapid, effective response to security incidents.