ZipRecruiter

Log In

Flashpoint
Flashpoint

60 Flashpoint Incident Response Analyst Jobs Hiring Near You

Astreya

Incident Response Analyst I

Austin, TX · On-site

$59K - $94K/yr

Leads incident handling, coordinates cross-functional responses, and performs forensic analysis. * Oversees incident response strategy, threat hunting, red/blue teaming initiatives, and executive ...

DocuSign

Sr. Incident Response Analyst

Austin, TX · Remote

$146K - $235K/yr

Collaborate effectively with other security teams, IT, and business units during incident response * Contribute to post-incident reports and analysis Job Designation Hybrid: Employee divides their ...

Centene

Principal Incident Response Analyst

Sorento, IL · On-site +1

$121K - $224K/yr

Executes enterprise-wide Incident Response Plan and recommends enhancements to improve security ... Advanced - Demonstrated analytical skills * Advanced - Demonstrated project management skills

New

Centene

Principal Incident Response Analyst

Argenta, IL · On-site +1

$121K - $224K/yr

Executes enterprise-wide Incident Response Plan and recommends enhancements to improve security ... Advanced - Demonstrated analytical skills * Advanced - Demonstrated project management skills

New

Centene

Principal Incident Response Analyst

$121K - $224K/yr

Executes enterprise-wide Incident Response Plan and recommends enhancements to improve security ... Advanced - Demonstrated analytical skills * Advanced - Demonstrated project management skills

Centene

Principal Incident Response Analyst

Hull, IL · On-site +1

$121K - $224K/yr

Executes enterprise-wide Incident Response Plan and recommends enhancements to improve security ... Advanced - Demonstrated analytical skills * Advanced - Demonstrated project management skills

New

Astreya

Incident Response Analyst I

Austin, TX · On-site

$59K - $94K/yr

Leads incident handling, coordinates cross-functional responses, and performs forensic analysis. * Oversees incident response strategy, threat hunting, red/blue teaming initiatives, and executive ...

Centene

Principal Incident Response Analyst

Dieterich, IL · On-site +1

$121K - $224K/yr

Executes enterprise-wide Incident Response Plan and recommends enhancements to improve security ... Advanced - Demonstrated analytical skills * Advanced - Demonstrated project management skills

New

previous page

Showing results 41-60

All JobsFlashpoint JobsFlashpoint Incident Response Analyst Jobs

Flashpoint Jobs Information

What other companies are hiring for Incident Response Analyst jobs?

SOC THREAT DETECTION & INCIDENT RESPONSE ANALYST

TECH-NET, INC

Folsom, CA • On-site

Other

Posted 8 days ago

Job description

SOC THREAT DETECTION & INCIDENT RESPONSE ANALYST
Job Title: SOC Threat Detection & Incident Response Analyst
Location: Remote
Position Type: Full-Time / Contract-to-Hire
Operational Shift: Monday – Friday, 7:00 AM – 6:30 PM PST (Coverage shift model)
 
1. Role Overview
Technet is seeking a SOC Threat Detection & Incident Response Analyst to provide active security monitoring, threat detection, incident triage, and response for a critical energy-sector utility billing and data management platform.
In this role, you will be responsible for active triage and correlation across CrowdStrike Falcon, a centralized Wazuh SIEM, AWS-native security services (GuardDuty, Security Hub, WAF), and application middleware. You will execute incident response actions and proactive threat hunts in strict alignment with utility emergency operations and incident response frameworks (CEOP/CIRP).
2. Technical Stack & Systems Monitored
  • Detection & SIEM Tools: Wazuh SIEM Dashboard & Correlation Engine, CrowdStrike Falcon (Falcon Console, FDR / Streaming API Telemetry).
  • Cloud Security Telemetry: Amazon GuardDuty, AWS Security Hub, AWS WAF, AWS CloudTrail, VPC Flow Logs, Route 53 Resolver logs.
  • Application & Data Tiers: Amazon RDS SQL Server audit logs, Windows Event Logs / IIS web logs, Dell Boomi middleware logs, GoAnywhere MFT transfer logs, Salesforce CRM connector logs.
  • Posture & Vulnerability Feeds: Wazuh SCA (Security Configuration Assessment), AWS Systems Manager (SSM) vulnerability findings, Containerized Prowler daily compliance reports.
  • Operational Frameworks: SOC 2 Type II controls, NIST CSF, and NIST 800-53.
3. Key Responsibilities
  • Active SOC Monitoring & Triage: Monitor cloud, endpoint, network, and application security alerts Monday through Friday (7:00 AM – 6:30 PM PST), adhering to strict SLAs (≤ 15 minutes for Critical severity; ≤ 1 hour for High severity).
  • Multi-Stage Threat Correlation: Correlate disparate signals across CrowdStrike Falcon endpoint detections, AWS GuardDuty anomalies, CloudTrail management events, IIS web server logs, and RDS SQL Server audit records to identify complete attack chains.
  • Threat Hunting: Conduct hypothesis-driven and intelligence-driven threat hunts focusing on cloud credential hijacking, IAM privilege escalation, impossible-travel anomalies, MFA bypass, and unauthorized data staging/exfiltration.
  • Integration Edge & File Transfer Monitoring: Perform targeted monitoring of GoAnywhere MFT, Dell Boomi, and external data exchanges (PG&E feeds) for anomalous file transfers, off-hours execution, or unauthorized outbound connections.
  • Incident Response & Containment: Execute response playbooks aligned with enterprise CEOP and CIRP frameworks. Perform host isolation recommendations, credential revocation coordination, and initial evidence preservation.
  • Vulnerability & Posture Prioritization: Review daily vulnerability scan outputs from Wazuh SCA/SSM and posture findings from Prowler; prioritize findings by business impact and exploitability, and track remediation with engineering teams.
  • Reporting & Governance: Assist in preparing monthly security posture reviews, threat intelligence summaries, and quarterly executive risk dashboards.
4. Required Qualifications & Technical Skills
  • Experience: 3+ years of hands-on experience in a Security Operations Center (SOC), Threat Analysis, or Incident Response role.
  • Tooling Proficiency: Direct experience analyzing alerts and querying logs within CrowdStrike Falcon, Wazuh (or ELK/OpenSearch/Splunk SIEM), and AWS Security Hub / GuardDuty.
  • Cloud & Identity Threat Knowledge: Practical experience analyzing AWS CloudTrail logs, detecting IAM abuse patterns, credential spraying, and web application attack vectors (OWASP Top 10, AWS WAF rules).
  • Log Analysis Skills: Strong ability to inspect and analyze raw logs from Windows Event Viewer, IIS web servers, database audit logs (SQL Server), and API/MFT transactional logs.
  • Incident Response Execution: Understanding of formal incident response methodologies (containment, eradication, recovery) and playbook execution.
  • U.S. Data Residency Requirement: Must reside and work exclusively within the United States.
5. Preferred Qualifications & Certifications
  • CompTIA CySA+, Security+, or GIAC Certified Incident Handler (GCIH)
  • GIAC Certified Enterprise Defender (GCED) or GIAC Cloud Forensics (GCFA)
  • Certified Information Systems Security Professional (CISSP) or CISM
  • AWS Certified Cloud Practitioner or AWS Certified Solutions Architect Associate
  • Prior experience in utility, public power, or critical infrastructure operations.

Apply