Lead Security Operations Analyst

Job not on LinkedIn

🔥 0 minutes ago

🇺🇸 United States – Remote

⏰ Full Time

🟠 Senior

🛡️ Security Operations

👻 Ghost score 12%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Wursta

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2014

💼 Consulting

🏥 Healthcare

📦 Logistics

Consulting • Healthcare • Logistics

Wursta is a B2B technology consultancy that delivers AI-driven workplace transformation and bespoke application development. The firm specializes in agentic AI adoption, Google Cloud platform design and managed services, Google Workspace/Digital Workplace migrations and optimizations, and cybersecurity and compliance services. Wursta provides custom development, managed IT/virtual admin support, training, and strategic advisory to help organizations align AI and cloud initiatives with business KPIs.

📋 Description

• Lead operational triage, analysis, and prioritization of complex security events across multi-tenant client environments • Serve as Incident Commander during critical security events • Execute containment, eradication, and recovery strategies according to NIST SP 800-61r2 • Lead proactive threat hunting and detection engineering using MITRE ATT&CK • Write custom correlation rules such as Sigma and YARA • Ensure incident notifications and responses meet contractual SLAs and regulatory reporting timelines • Extend the MSSP application backend with production-grade Python, Node.js, or Go code • Build integrations for EDR, DNS security, threat intelligence, spam/phishing, identity management, firewall, and IDS telemetry • Design SOAR playbooks for dynamic triage, identity enrichment, and automatic tenant isolation • Implement LLM-based alert summarization and enrichment using Gemini, BigQuery, REST webhooks, RAG pipelines, and MCP servers • Optimize detection pipelines with machine learning and AI filters to reduce false positives • Align monitoring controls with NIST CSF 2.0, ISO/IEC 27001:2022, and NIST SP 800-53r5 • Ensure incident response and telemetry collection comply with GDPR, Brazil LGPD, and US state privacy laws

🎯 Requirements

• Experience in at least one platform or tool in each required category: SIEM/XDR, network/telemetry, AI/automation, SOAR/scripting, threat frameworks, and cloud environments • SIEM/XDR experience with Splunk, Microsoft Sentinel, Elastic SIEM, CrowdStrike Falcon, SentinelOne, or Palo Alto Cortex XDR • Network and telemetry experience with Wireshark, Zeek, Suricata, PCAP analysis, Syslog, Windows Event Logs, or CloudTrail/CloudWatch • AI and automation experience with Python (Pandas, Requests), REST APIs, Cursor IDE, GitHub Copilot, Claude/OpenAI APIs, LangChain, Webhooks, or Docker • SOAR and scripting experience with Python, PowerShell, Bash, Demisto/Cortex XSOAR, Shuffle, or Tines • Knowledge of MITRE ATT&CK, NIST SP 800-61r2, Cyber Kill Chain, YARA, and Sigma Rules • Experience with AWS, Azure, or GCP security architectures, IAM, and log architectures • 3+ years in a SOC or MSSP environment preferred • 2+ years in a Level 3 / Lead SOC capacity preferred • Hands-on scripting and API integration experience to build automated incident response playbooks • Proficiency with AI-assisted coding tools such as Cursor or Copilot • Expertise in log analysis across endpoint, identity, network, and multi-cloud environments • At least one required certification: GCIH, GMON, GNFA, CySA+, CASP+, or OSCP • CISSP preferred

🏖️ Benefits

• Equal employment opportunity and anti-discrimination protections • Interview process includes a work style survey, hiring coordinator screen, manager interview, peer interview, and senior leadership interview • Decision typically provided within one week after interviews