> Markdown version of [/jobs/ext/4588406-cyber-defense-operations-analyst](https://www.wearedevelopers.com/jobs/ext/4588406-cyber-defense-operations-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Defense Operations Analyst

- **Company:** Epic Games, Inc.
- **Location:** United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Software as a Service, Cyber Security, Computer Programming, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Security Information and Event Management, Scripting, Cloud Platform System, Mitre Att&ck, Splunk
- **Published:** November 5, 2026
- **Apply:** https://startup.jobs/senior-cyber-defense-operations-analyst-epic-games-10672036

## About the Role

* 5+ years of experience in security operations, incident response, or threat detection, including leading investigations end-to-end
 * Deep hands-on experience with SIEM and EDR platforms (e.g., Splunk, Google SecOps, CrowdStrike NGSIEM, etc.) and writing effective queries and detections
 * Strong understanding of attacker tradecraft and frameworks such as MITRE ATT&CK, with the ability to reconstruct activity from logs and telemetry
 * Experience investigating in cloud environments (AWS and/or GCP), SaaS, and identity platforms
 * Scripting or programming skills (Python or similar) and a drive to automate repetitive work; SOAR experience is a plus
 * Curiosity about Al and emerging technology, and interest in applying them to security operations responsibly
 * Calm, decisive judgment under pressure, with the ability to prioritize competing incidents and communicate clearly to technical and executive audiences
 * Strong written communication, with a high standard for incident documentation and reporting
 * A self-directed, ownership-driven approach and a willingness to challenge how things have always been done

## Description

* Lead the triage, investigation, and response for security alerts and incidents across cloud, corporate, endpoint, identity, and production environments
 * Act as an escalation point and incident lead, coordinating with engineering, legal, privacy, and business partners through containment, remediation, and post-incident review
 * Drive the detection lifecycle management, developing, tuning, and retiring detection logic to maximize signal-to-noise ratio, minimize alert fatigue, and close emerging threat gaps
 * Identify recurring analyst work and partner with security engineering to automate it, including Al-agent workflows with clear validation and human review where it counts
 * Turn threat intelligence and emerging vulnerabilities into rapid exposure assessments and actionable response across the company
 * Develop and maintain playbooks, runbooks, and operational metrics that make the SOC faster, more consistent, and easier to scale
 * Set and elevate standards for investigation quality and case documentation, actively coaching analysts and holding managed-service partners accountable to rigorous SLAs and analytical depth