The posting
This team provides 24/7 support. This role requires shift flexibility, including the ability to rotate between days, mids, and nights.
The Principal Analyst will provide deep-level analysis for client investigations utilizing customer-provided data sources, audit, and monitoring tools at both the government and enterprise levels. The Principal Analyst will work closely with our Technology Engineers, Architects, and Threat Analysts to service customers.
How you'll make an impact
- Operate independently in a geographically dispersed team, while maintaining situational awareness and keeping the team up to date
- Perform security monitoring and incident response activities across the networks, leveraging a variety of tools and techniques
- Detect incidents through proactive “hunting” across security-relevant data sets
- Thoroughly document incident response analysis activities
- Review investigations conducted by more junior analysts to ensure quality standards are met
- Develop new, repeatable methods for finding malicious activity across the networks
- Provide recommendations to enhance detection and protection capabilities
- Regularly present technical topics to technical and non-technical audiences
- Develop and follow detailed operational processes and procedures to appropriately analyze, escalate, and assist in the remediation of information security incidents
- Prioritize multiple high-priority tasks and formulate responses/recommendations to customers and team members in a fast-paced environment
- Provide assistance to other security teams
- Continually develop new technical skills and push overall team capabilities forward
- Engage with and mentor other team members
- Work with other teams on major engineering and architecture initiatives
- Be innovative with their understanding of attack methodologies, malware analysis, malicious toolkits, and how those may manifest within various security technologies
- Advanced proactive threat hunting
- Understands advanced adversary emulation concepts
- Advanced use case design for insider threat, operational, threat detection and response
- Review of defensive and detective controls to reduce client attack surface
What we’re looking for
- 9+ years of hands-on cybersecurity operations experience across complex security investigations, incident response, threat hunting, detection engineering, and security control assessment in enterprise environments.
- Experience in Cortex XSOAR, Proofpoint, Egress, MS Azure, MS Defender, Azure ADX, Crowdstrike.
- Advanced understanding of the cyber threat landscape and adversary TTPs, with extensive experience applying MITRE ATT&CK to investigations, threat hunting, detection engineering, adversary behavior analysis, and detection coverage assessment.
- Lead complex, multi-source investigations using endpoint, network, identity, cloud, SaaS, memory, disk, and log evidence; preserve evidence, reconstruct attacker timelines, determine root cause and scope, and produce technically defensible findings.
- Investigate identity- and cloud-centric attacks involving privileged accounts, federation, OAuth applications, tokens, service identities, control-plane/API activity, cloud workloads, SaaS audit records, and cross-account or cross-tenant access.
- Demonstrated proficiency in SIEM, EDR/XDR, UEBA, and security data platforms, including developing and optimizing complex queries and correlating telemetry across endpoint, identity, cloud, SaaS, and network environments.
- Use Python, PowerShell, or comparable scripting languages, REST APIs, and orchestration/SOAR platforms to automate enrichment, evidence collection, threat hunting, detection deployment, and repeatable response activities.
- Own the detection lifecycle end-to-end, including requirements, data validation, use-case and rule development, peer review, testing, deployment, performance monitoring, tuning, documentation, and retirement, with analysis of both false positives and false negatives.
- Design and execute hypothesis-driven and exploratory threat hunts based on adversary behavior, threat intelligence, MITRE ATT&CK coverage gaps, and incident learnings, converting validated findings into detections, analytics, or response content.
- Assess telemetry quality and detection visibility, identify logging, ingestion, normalization, retention, and coverage gaps, and collaborate with engineering and architecture teams to improve security monitoring and investigation capabilities.
- Serve as technical lead for significant security incidents, defining investigative priorities, evidence-preservation requirements, scoping decisions, containment strategies, remediation validation, and technical handoffs while considering operational and business impact.
- Demonstrate advanced endpoint and network investigation capabilities, including Windows/Linux security artifacts, EDR/XDR telemetry, packet captures, DNS, proxy, firewall, flow, and related data to identify command-and-control, lateral movement, persistence, exfiltration, and attacker infrastructure.
- Operationalize threat intelligence by translating adversary TTPs, infrastructure, vulnerabilities, and campaign intelligence into prioritized hunts, behavioral analytics, detection logic, investigation guidance, and defensive-control improvements.
- Perform advanced phishing and malware analysis, including malicious URLs, attachments, sender infrastructure, authentication artifacts, behavioral/static malware analysis, persistence, execution, and communications; advanced reverse engineering is not required.
- Provide Principal-level technical leadership, including reviewing complex investigations and detections for quality and accuracy, mentoring analysts, developing repeatable investigation and response methodologies, and collaborating with Security Engineering, Architecture, Threat Intelligence, Incident Response, Cloud, and Identity teams.
- Strong analytical, problem-solving, documentation, and communication skills, with the ability to operate independently in a globally distributed environment and communicate complex technical findings to technical and non-technical stakeholders.
- Excellent English fluency required. This role is Work from Office position
- This role demands to be flexible for rotational shifts 24/7.
What you can expect from Optiv
- A company committed to our inclusive value through our Employee Resource Groups
- Work/life balance
- Professional training resources
- Creative problem-solving and the ability to tackle unique, complex projects
- Volunteer Opportunities. “Optiv Chips In” encourages employees to volunteer and engage with their teams and communities.
- The ability and technology necessary to productively work remotely/from home (where applicable)
EEO Statement
Optiv is an equal opportunity employer. All qualified applicants for employment will be considered without regard to race, color, religion, sex, gender identity or expression, sexual orientation, pregnancy, age 40 and over, marital status, genetic information, national origin, status as an individual with a disability, military or veteran status, or any other basis protected by federal, state, or local law.
Optiv respects your privacy. By providing your information through this page or applying for a job at Optiv, you acknowledge that Optiv will collect, use, and process your information, which may include personal information and sensitive personal information, in connection with Optiv’s selection and recruitment activities. For additional details on how Optiv uses and protects your personal information in the application process, click here to view our Applicant Privacy Notice. If you sign up to receive notifications of job postings, you may unsubscribe at any time.
