Senior Security Analyst

Accountabilities:: As Senior Security Analyst, you will oversee daily security monitoring, compliance execution, incident response, and access management. You will ensure security activities are completed on schedule, properly documented, and aligned with established policies and regulatory requirements. Security Monitoring and Log Reviews: Conduct daily security log reviews across Trend Micro, CrowdStrike, Feroot, Amazon Cognito, AWS GuardDuty, databases, and firewalls. Document review scope, results, coverage gaps, and related incidents in tickets, tracking exceptions through resolution. Compliance and Audit Readiness: Own the assigned PCI DSS and SOC 2 control calendar, complete recurring control activities, retain audit evidence, monitor overdue actions, and coordinate access reviews, Approved Scanning Vendor (ASV) scans, remediation, and rescans. Respond to internal and external auditor evidence requests. XDR and File Integrity Monitoring: Maintain Extended Detection and Response (XDR) and approved File Integrity Monitoring (FIM) configurations. Verify agent coverage, health, and updates, apply authorized routine adjustments, and coordinate remediation with system owners. Authentication Monitoring: Monitor authentication failures, suspicious login activity, and potential account takeover indicators in Amazon Cognito. Investigate anomalies and coordinate with application owners to resolve authentication and login availability issues. Cloud and SIEM Operations: Verify AWS GuardDuty coverage across all relevant accounts and regions, investigate findings, and monitor Sumo Logic log delivery, alerts, and dashboards. Escalate collection failures, monitoring gaps, and other issues that could affect detection capabilities. Identity and Access Management: Provision, modify, and revoke user access promptly in response to approved requests. Enforce least-privilege access and multi-factor authentication (MFA), document approvals and changes, and coordinate periodic access certifications with system owners. Incident Response: Lead incident triage and investigation, perform authorized containment actions, and coordinate resolution with internal teams and external vendors. Maintain incident timelines, post-incident reports, and root cause analyses for qualifying events. Firewall Management: Investigate firewall anomalies, maintain rule justifications and approval records, and coordinate monthly firewall rule reviews and authorized routine changes with network engineers. Documentation and Reporting: Maintain security procedures and incident response runbooks in Confluence, reviewing them quarterly and following relevant incidents or operational changes. Produce monthly reports covering control completion, monitoring coverage, security incidents, access changes, and overdue actions. Performance and Control Effectiveness: Ensure daily log reviews are completed on schedule, compliance activities meet deadlines, ASV scan findings are remediated within required timeframes, and security monitoring coverage is maintained across in-scope systems. Continuous Improvement and Team Support: Identify gaps in detection, controls, and operational processes; recommend improvements; share knowledge; and support the development of less experienced team members. Operational Coverage: Participate in after-hours incident response coverage, including designated weekend and holiday backup rotations, ensuring continuity during absences and leave. Requirements: The ideal candidate combines practical security operations experience with strong analytical skills, sound judgment, and a disciplined approach to compliance documentation. You should be comfortable investigating alerts independently, managing recurring control requirements, and coordinating security activities across technical teams. 3–5 years of hands-on experience in security operations or a related IT security discipline, including independent alert investigation, incident triage, and identity administration. Practical experience with AWS services, particularly GuardDuty and Cognito, alongside SIEM queries, XDR tools, Windows and Linux logs, and network security technologies. Experience with comparable products is also accepted. Working knowledge of PCI DSS and SOC 2 control execution, audit evidence management, least-privilege access, change control, and incident response procedures. Ability to work independently, manage recurring compliance deadlines, prioritize competing demands, and maintain consistent operational execution. Strong documentation skills, including the ability to maintain clear tickets, incident timelines, audit evidence, procedures, and root cause analyses. Excellent written and verbal communication skills, with the ability to collaborate effectively with application, infrastructure, network, and compliance teams. Availability to participate in after-hours incident response, including a weekend and holiday backup rotation. Preferred education: Bachelor's degree in Information Security, Computer Science, or a related field. Preferred industry experience: Experience in payments, financial technology, or another environment subject to PCI DSS requirements. Preferred certifications: CompTIA Security+, CompTIA CySA+, GIAC certifications such as GCIH or GCIA, SSCP, CISSP, or other relevant security credentials. Preferred technical experience: Hands-on familiarity with Trend Micro, CrowdStrike, Feroot, or Sumo Logic. Additional advantage: Scripting experience with Python or Node.js. Benefits: Competitive annual salary: USD $125,000–$150,000. Fully remote work: Work remotely from the United States. Meaningful security ownership: Take responsibility for day-to-day security operations and compliance controls in a payment processing environment. Senior-level autonomy: Independently manage operational priorities, investigate incidents, and serve as an escalation point for security issues. Professional development: Opportunities to strengthen expertise in cloud security, threat detection, incident response, payment security, and regulatory compliance. Cross-functional collaboration: Work alongside application, infrastructure, network, engineering, and compliance stakeholders. Continuous improvement: Contribute to strengthening security controls, improving monitoring coverage, and enhancing operational processes as the business grows.