On Call Phishing Analyst Jobs (NOW HIRING)

Global Security Operations protects SharkNinja's global technology environment by detecting, investigating, and responding to cybersecurity threats - and by continuously strengthening our defenses. We partner across Security & Privacy and IT to protect our systems, data, associates, and business operations.

As Senior Security Analyst, you'll be a senior technical resource across incident response, EDR, email security, threat intelligence, and threat hunting. You'll investigate complex security events, contain threats, hunt proactively for malicious activity, and turn threat intelligence into concrete defensive improvements.

The work requires synthesizing signals across endpoint, identity, email, network, and cloud telemetry into a clear picture of adversary activity - then communicating that picture to people who need to act on it. You'll also participate in the team's on-call rotation, supporting significant security events outside normal business hours.

• Lead incident response across SharkNinja's global environment: triage, investigation, containment, remediation coordination, recovery, documentation, and post-incident analysis - maintaining clear ownership from detection through resolution.
• Investigate complex security events by correlating evidence across endpoint, identity, email, network, and cloud telemetry to determine scope, impact, root cause, and required response.
• Serve as the EDR subject matter expert, using endpoint telemetry to investigate malicious activity, understand attacker behavior, contain threats, and improve endpoint detection capabilities.
• Lead email security investigations - phishing, business email compromise, malicious payloads and links, impersonation, and other email-borne threats.
• Run proactive threat hunts built on hypotheses drawn from telemetry, intelligence, known attacker behaviors, and anomalous activity, targeting threats that evade existing controls.
• Operationalize threat intelligence by evaluating indicators, adversary behaviors, and emerging campaigns, then translating what matters into hunts, detections, blocking actions, and control improvements.
• Build and tune detection logic to increase fidelity, reduce noise, and catch malicious behavior earlier in the attack lifecycle. Validate that controls and detections work as intended and provide the visibility we need.
• Operate and optimize enterprise security tooling, identifying opportunities to improve effectiveness, integration, coverage, and scalability.
• Drive post-incident improvement through root-cause analysis and lessons learned that translate into durable changes to detections, controls, configurations, playbooks, and processes - including maintaining IR procedures, investigation playbooks, and escalation paths.
• Automate repetitive operations work through scripting, APIs, and orchestration to improve investigation speed, consistency, and scale.
• Advise and partner across the business, serving as an expert resource to Security & Privacy, IT (infrastructure, identity, networking, cloud, applications, endpoint), and business stakeholders - and mentoring other analysts to strengthen investigation methodology across the team.
• Participate in the on-call rotation, responding to and coordinating significant security events outside normal business hours as required.

• Strong hands-on cybersecurity experience with demonstrated depth in incident response and security investigations.
• Advanced experience with enterprise EDR: telemetry analysis, investigation, containment, detection tuning, and hunting.
• Strong knowledge of enterprise email security - phishing analysis, BEC, malicious attachments and URLs, impersonation techniques, and email authentication concepts.
• Demonstrated experience consuming threat intelligence and translating it into investigations, detections, hunts, and defensive controls.
• Hands-on experience developing and executing hypothesis-driven threat hunts.
• Strong understanding of attacker TTPs, with experience applying frameworks such as MITRE ATT&CK to investigations, detection development, and hunting.
• Experience investigating events across enterprise SIEM, endpoint, email, identity, network, and cloud telemetry - with the ability to correlate high volumes of data, recognize meaningful patterns, and separate malicious activity from benign.
• Solid grounding in operating systems, TCP/IP, networking concepts, and protocols relevant to incident investigation.
• Experience developing, tuning, and validating detections and identifying gaps in monitoring coverage.
• Strong analytical and problem-solving skills, with the ability to work independently through complex and ambiguous security issues.
• Strong written and verbal communication skills, including the ability to translate technical investigations into clear assessments of impact, risk, and recommended action for non-technical audiences.
• Willingness to participate in an on-call rotation.
• University degree, technical degree, or equivalent professional experience.

Preferred: Scripting and automation experience (Python, PowerShell, APIs, or equivalent). Industry security certifications are a plus but not required - demonstrated technical expertise and investigative judgment matter more.

Our values shape how this team operates:

• Rarely Satisfied - we're never done improving our defenses.
• Relentless Drive for Edge - curiosity about attacker techniques, emerging threats, and new capabilities.
• Insatiable Impatience for Action - decisive response when threats are active.
• Details Make the Difference - rigor in evidence collection, investigation quality, and follow-through.
• Progress Over Perfection - rapid, risk-informed decisions when the situation demands them.
• Deep-Seated Confidence - challenging assumptions, articulating technical positions, and escalating real risk.
• Communicate for Impact - clarity about what happened, what it means, and what to do next.
• Winning Is a Team Sport - collaboration across functions and geographies during incidents and improvement work.
• Genuine Belief in the Journey - our global security capabilities are still maturing, and that's the opportunity.