> Markdown version of [/jobs/ext/4606235-senior-security-analyst](https://www.wearedevelopers.com/jobs/ext/4606235-senior-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Security Analyst

- **Company:** LEADS
- **Location:** New York, NY, United States
- **Experience:** Expert
- **Salary:** $142,875.0 - $170,910.0
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Amazon Web Services, Apple Mac Systems, Microsoft Azure, Bash Shell, Cloud Computing, Cloud Computing Security, Cyber Security, Continuous Integration, Extract Transform Load (ETL), Data Normalization, Database Queries, Github, Intrusion Detection and Prevention, Python (Programming Language), Network Security, Linux Kernel, Log Analysis, Routing, Security Information and Event Management, Web Traffics, Scripting, Mitre Att&ck, Cloudformation, National Institute of Standards and Technology Cybersecurity Framework, Terraform
- **Published:** November 6, 2026
- **Apply:** https://www.adzuna.com/details/5945438079

## About the Role

* 5+ years in information security or security operations
 * Hands-on SIEM experience with query writing, detection building, and alert tuning
 * Strong working knowledge of cloud security concepts and services (AWS preferred; GCP and Azure also considered)
 * Proficiency working with logs across endpoint, cloud, network, identity, and application sources
 * Understanding of CI/CD pipelines and IaC (Terraform, CloudFormation) from a security perspective
 * Solid grasp of Windows, macOS, and Linux internals - processes, persistence mechanisms, and attacker TTPs
 * Demonstrated IR experience, including leading or contributing to investigations
 * Familiarity with data normalization, log parsing, and ETL concepts
 * Strong written and verbal communication skills

Preferred

 * Experience with log routing, transformation, and enrichment
 * Hands-on experience with an enterprise EDR/XDR platform and its ecosystem tooling - SOAR, exposure management, and identity protection
 * Experience with network security tools and interpreting proxy or web traffic logs Background in a regulated industry (financial services, healthcare) with familiarity with NIST CSF, GLBA, or FFIEC
 * Scripting or automation experience (Python, Bash) for detection engineering, workflow automation, and version-controlled code in GitHub
 * Relevant certifications: CISSP, GCIH, GCIA, GCED, CEH, GDSA, or equivalent

Nice to Have

 * Detection as Code experience using version-controlled detection content
 * Exposure to identity security tooling

## Description

* Build, tune, and maintain detection rules and alerts in our SIEM, writing queries to identify threats and coverage gaps aligned to MITRE ATT&CK
 * Own incident response execution end-to-end - containment, eradication, recovery, and lessons learned - including forensic log analysis and post-incident reporting
 * Monitor and investigate security events across endpoints, cloud (AWS), identity, and network telemetry - identifying misconfigurations, anomalous activity, and suspicious behavior
 * Assist with security audits and regulatory examinations, ensuring timely and accurate security documentation and evidence is provided
 * Analyze systems, applications, and networks for security configurations in partnership with security engineers.
 * Manage log pipelines including ingestion, parsing, normalization, and enrichment to ensure high-fidelity data is available for detection and investigation
 * Triage and prioritize vulnerability findings using risk-based frameworks and track remediation SLAs with IT and Engineering
 * Collaborate with Engineering on IaC and CI/CD security reviews, and contribute to runbooks and playbooks
 * Perform all other duties as assigned