> Markdown version of [/jobs/ext/3967149-security-analyst-security-operations](https://www.wearedevelopers.com/jobs/ext/3967149-security-analyst-security-operations). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Analyst Security Operations - **Company:** Nscale AS - **Location:** San Francisco, CA, United States - **Experience:** Expert - **Salary:** $100,000.0 - $130,000.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Software as a Service, Cloud Computing, Cyber Security, Data Centers, Query Languages, Intrusion Detection and Prevention, Regression Testing, Anti-Phishing, AI Infrastructure, Scripting, Computer Network Operations, High Performance Computing, Cybercrime, Process Control Systems - **Published:** October 27, 2026 - **Apply:** https://www.careerbuilder.com/job-details/security-analyst-security-operations-san-francisco-ca--ac834f63-e173-4759-b5b8-71198b002ea9 ## About the Role Security Analysis, Operational Audit, Startup, Cost Control, Artificial Intelligence (AI), Customer Support/Service, Network Operations Center, Cloud Computing, Technical Recruiting, Security Monitoring, * 5+ years in security operations, incident response, threat detection, threat hunting, security engineering, or related roles. * Hands-on investigation experience across endpoint, identity, cloud, SaaS, network, or production telemetry, with the ability to build a timeline from primary evidence rather than a vendor summary. * Fluency in modern attacker tradecraft, including credential theft, session abuse, phishing, malware execution, persistence, privilege escalation, lateral movement, command and control, and exfiltration. * You automate what you repeat, using query languages, scripting, APIs, or workflow automation. When you hit the same problem a third time, your instinct is to build-not add another step to a runbook. * Sound judgement on containment under time pressure, including knowing where your authority ends. * You write investigations another engineer can follow, escalations a leader can act on in thirty seconds, and case notes that still make sense to someone reading them two years later in an audit. * Calm and methodical when facts are incomplete or contradict each other. * Willingness to challenge automated conclusions. AI-generated analysis is an input, not an authority; we expect you to validate it and notice when it is confidently wrong. * Ability to work effectively with engineering, infrastructure, and service owners who do not report to you. Strong pluses * Operational technology, industrial control systems, building management systems, or critical facilities experience. We have a known gap here and will weight it heavily. * Cloud infrastructure, AI infrastructure, data centres, HPC, or other availability-sensitive environments. * Response experience involving ransomware, identity compromise, destructive attacks, cloud intrusion, insider threats, or supply-chain incidents. * Experience holding a managed monitoring or response provider to a standard while keeping decisions in-house. * Detection testing, shadow-rule validation, threat hunting, or forensic readiness. * Follow-the-sun, shift-based, or on-call operations. * Certifications are useful, but not required. ## Description We are hiring Security Response Engineers to own what happens after an alert becomes real, across enterprise, cloud, production, data centre, and operational technology environments. Agents and a managed security service provider (MSP) hold the level 1 queue. You take escalations, decide fast, act, and then make sure the same class of problem does not come back. Half the job is response. The other half is turning what you learned into engineering work that permanently retires the issue. If you have spent years closing the same ticket every Tuesday-and knowing exactly how to fix it for good, but never having the mandate-this is the job where that is the mandate. How this function works Read this section carefully. It is not a standard SOC, and the difference is the whole point. * You do not watch a queue. An in-house security agent and a contracted managed provider hold level 0 and level 1 around the clock. Work reaches you as an escalation with context already attached. * Every escalation forks three ways: act, solve, or both. Act is the immediate containment. Solve is the engineering artifact you hand to the build teams so that alert class does not fire again. Most escalations are both. * Your primary metric is the share of escalations permanently solved. Not tickets closed, and not mean time to close. If the same alert fires twice, we got it wrong the first time. * Two classes, not five. We sort everything into risk indicator or actionable, using the SSVC model. If you have drowned in a five-tier severity scheme nobody trusted, you will like this. * Follow-the-sun across hubs. Nobody works permanent nights. What you''ll be doing Escalation response * Take escalations from the agent and managed provider, scope them against real asset and business context, decide, and act. * Execute approved containment, including isolating devices, revoking sessions, restricting access, blocking activity, and preserving evidence. * Know what you can do immediately, what requires authority, and what could disrupt production if handled incorrectly. The solve * Ensure every escalation exits with an engineering artifact where one is warranted: a detection requirement, telemetry gap with a business case, control change, automation, or regression test. * Specify the artifact clearly enough that the team building it can act without a second conversation. You do not build it; you make the required outcome unambiguous. Investigation and evidence * Build timelines from primary evidence across identity, endpoint, email, SaaS, cloud, network, production, and increasingly operational technology and building management systems, which are currently dark to us. * Close every case with a security disposition, an owner, the evidence, actions taken, and any required follow-up. Detection judgement * Review candidate detections auto-authored by our research loop as shadow rules and assess their inside-out coverage. * Make the human judgement on whether shadow detections should be promoted to live. You do not write the detection logic, but nothing goes live without your call. Provider quality * Reconcile the managed provider's case work, which lives in their platform rather than ours, against our standards. * Hold the provider accountable for evidence, analysis, routing, and closure quality. Readiness * Contribute to threat hunts, incident reviews, tabletop exercises, recovery tests, the on-call rotation, and keeping runbooks honest. First 90 days * Independently own escalations across common classes, with defensible dispositions and evidence that stands up. * Ship your first solve: an engineering artifact that permanently retires a recurring alert class. * Learn the incident command, escalation, evidence, and handover model, and take a rotation slot. * Review the managed provider's case quality against our standard and raise the first reconciliation findings. * Judge and promote your first shadow detections to live. * Take part in a threat hunt, tabletop, or recovery exercise. * Name one telemetry gap with a business case behind it. Extra credit if it is in operational technology or building management systems, both of which we currently cannot see. KPIs * Share of escalations permanently solved * Quality and defensibility of security dispositions and evidence * Containment judgement and response effectiveness * Quality and actionability of engineering artifacts * Managed provider quality and reconciliation, The responsibilities outlined in this job description are not exhaustive and are intended to provide a general overview of the position. The employee may be required to perform additional duties, tasks, and responsibilities as assigned by management, consistent with the skills and qualifications required for the role.