Cybersecurity Analyst

Description

The analyst supports daily security operations and incident response. The work covers monitoring and investigating threats, coordinating responses to incidents, running threat intelligence and threat hunting, handling operational vulnerability workflows, and keeping case records and security metrics up to date.

Security Engineering builds and runs the security platforms and vulnerability scanning tools. Technology and application owners carry out the fixes.

The company provides pet medical insurance for cats and dogs across North America. The team works in a collaborative setting.

This role is open to candidates in the Seattle, WA area. The schedule is hybrid, mixing remote work with at least 3 days a week in the casual, pet-friendly office.

Responsibilities

• Watch and sort alerts from identity, endpoint, email, network, cloud, application, vulnerability, and data-protection tools.
• Check, add context to, classify, and rank security events. Investigate phishing, account takeovers, malware, ransomware, unauthorized access, data exposure, insider threats, and events involving third parties.
• Take approved containment steps within your assigned permissions. Work with Technology Operations on changes to infrastructure or production systems.
• Gather and preserve evidence. Determine which users, devices, accounts, systems, repositories, and data are affected. Help with removing threats, confirming recovery, increased monitoring, and closing cases.
• Gather and assess intelligence from commercial, government, industry, open-source, MDR, vendor, and internal sources.
• Assess threat actors, campaigns, tactics, techniques, procedures, indicators, exploited vulnerabilities, and targeted technologies for their relevance to the company.
• Write tactical and operational intelligence reports. Turn findings into investigations, detections, hunting queries, watchlists, blocks, phishing simulation scenarios, and runbook updates.
• Run hypothesis-led hunts across identity, endpoint, email, network, cloud, and application data using MITRE ATT&CK. Record the scope, queries, evidence, findings, and follow-up actions.
• Confirm vulnerability findings, judge risk and business exposure, and rank fixes using threat intelligence and incident data. Look for signs of exploitation and escalate urgent vulnerabilities.
• Hunt for threats against affected technologies. Recommend temporary containment or monitoring when active exploitation or a link to an incident is found.
• Work with Security Engineering, which owns the vulnerability scanners, integrations, technical configuration, and platform reliability.
• Assign remediation work to technology and application owners. Keep the vulnerability ticket queue moving, track progress against set service levels, report overdue exposures, and escalate ownership or delivery problems through the defined governance process.
• Oversee vulnerability validation, prioritization, ticketing, fix follow-up, SLA reporting, and escalation. The owner of the affected asset or service still performs the fix.
• Build and maintain approved automation workflows, scripts, and playbooks for enriching alerts, investigating, responding within authority, and keeping cases consistent.
• Preserve identity, endpoint, email, cloud, network, application, and audit log evidence following approved forensic, legal-hold, integrity, and chain-of-custody procedures.
• Keep complete case records that cover severity, affected assets, evidence, analysis, actions, decisions, communications, and the reason for closure.
• Confirm that containment and corrective actions worked, using available telemetry, testing, or monitoring.
• Support breach investigations by identifying affected repositories, records, data types, individuals, business entities, and jurisdictions for Legal and Privacy review.
• Investigate token theft, MFA changes, privilege escalation, malicious app consent, mailbox manipulation, and compromised user, privileged, service principal, or workload identities.
• Investigate security notices and suspected misuse related to third parties, supply chains, and AI. Record the company's potential exposure.
• Carry out alert triage, investigations, MDR monitoring, threat intelligence analysis, threat hunting, vulnerability validation and ranking, fix follow-up, security metrics and reporting, case documentation, and approved actions in security tools.
• Send architecture questions, complex integrations, detection platform design, routine vulnerability program administration, and permanent engineering needs to Security Engineering.
• Hand over active alerts, incidents, intelligence, investigations, and urgent exploitable vulnerabilities in structured form across operating regions.
• Give technical evidence to Legal and Privacy. Leave legal privilege, regulatory interpretation, and notification decisions to them.

Requirements

• A bachelor's degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or a related field, or equivalent hands-on experience.
• 3+ years in cybersecurity operations, incident response, IT operations, system administration, network security, or a closely related area.
• Experience investigating alerts with SIEM, EDR/XDR, identity, email, cloud, network, or vulnerability tools.
• Knowledge of common attacker methods, including phishing, malware, account compromise, privilege misuse, lateral movement, data exfiltration, and vulnerability exploitation.
• Proven ability to use threat intelligence and incident data to rank vulnerabilities and judge whether they are being exploited.
• Experience with security automation or scripting, digital evidence handling, identity investigations, third-party incident analysis, and structured case management.
• Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments.
• Familiarity with MITRE ATT&CK and common detection, threat hunting, and incident response methods.
• Understanding of vulnerability scanning and fix workflows, and of how responsibility splits between program governance, threat-led escalation, and asset-owner remediation.
• Knowledge of NIST CSF, ISO 27001, PCI DSS, NYDFS cybersecurity rules, or privacy and breach response obligations.
• A relevant certification such as Security+, CySA+, SC-200, GCIH, or GCIA is preferred, as is equivalent experience.
• Ability to cover US business hours and join an escalation or on-call rotation.
• Availability to help with high-severity incidents outside normal working hours when needed.
• Ability to handle confidential, legally sensitive, and security-restricted information with care.

Conditions

Base salary is $120,000 to $140,000 for a full-time position.

Employees are currently eligible for monthly bonuses.

New hires receive Restricted Stock Units, which vest over 4 years.

The role is hybrid, with the in-office days described above in Seattle, WA.

Applicants must be authorized to work for any employer in the U.S. The company cannot sponsor or take over an employment visa at this time.

The company is an equal-opportunity employer that values diversity and seeks a team with a range of backgrounds, abilities, perspectives, and skills.

Benefits

• Medical, dental, and vision coverage at no cost to the employee.
• Four weeks of paid time off plus 9 paid float holidays, which you choose.
• A five-week sabbatical after five years of employment.
• An open, casual, pet-friendly, and fun office.
• Free medical insurance for one pet dog or cat.
• Paid time off to volunteer for nonprofit organizations.
• Seattle office perks: a free on-site gym, free dog walking for office pets during business hours, free parking, and paid ORCA cards.