Senior Cyber Defense Analyst, Abnormal Security

• 5-7 years of hands-on SOC or Incident Response experience in a cloud-first or hybrid environment
• Strong understanding of attacker lifecycle, MITRE ATT&CK, and threat actor TTPs
• Experience with EDR (CrowdStrike preferred), SIEM (Splunk preferred), and SOAR (Torq, XSOAR, or Phantom)
• Familiarity with AWS, Okta, and SaaS platforms
• Proficiency in writing queries and automations using Python, SPL, or equivalent
• Excellent analytical and investigative skills — capable of operating independently with minimal hand-holding
• Strong documentation and communication skills for technical and executive audiences
• Knowledge of Containers and Kubernetes security

Desirable

• We at Abnormal AI are looking for a hands-on Security Operations/ Cyber Defense Analyst who thrives in a fast-paced, engineering-driven environment
• You’ll be responsible for monitoring, investigating, and responding to security alerts across cloud, endpoint, identity, and application layers
• You’ll work closely with detection engineers, cloud security, and IT teams to protect our hybrid environment from threats in real time
• This is not a “click-through-the-console” SOC role — we’re looking for someone who can think critically, automate relentlessly, and own incidents end-to-end
• Monitor alerts from tools like SIEM, EDR, IAM, CSPM, CDR etc
• Perform initial triage, enrichment, and correlation across multiple data sources
• Identify false positives and fine-tune rules with detection engineering
• Lead containment, eradication, and recovery for endpoint, cloud, and identity incidents
• Document and communicate incidents through SOAR/Jira/ServiceNow workflows
• Perform root cause analysis and propose permanent preventive controls
• Proactively hunt using hypotheses mapped to MITRE ATT&CK
• Investigate anomalies across CloudTrail, Okta, GitHub, and other telemetry sources
• Collaborate with threat intelligence to identify emerging TTPs
• Build or enhance playbooks in SOAR (Torq or equivalent)
• Create custom enrichment scripts and automations (Python, Bash, etc.)
• Suggest new detection logic and operational improvements
• Track and report operational metrics (MTTD, MTTR, incident categories)
• Maintain documentation and lessons learned