Senior Cyber Defense Analyst

Overview

Senior Cyber Defense Analyst role reporting to the Manager, Threat Management Center, operating within Google SecOps to lead incident response, investigations, and continuous improvement of response standards.

What you'll do

• Serve as the Threat Management Center's subject matter expert for incident response, leading end-to-end investigation, containment, eradication, and recovery for confirmed security incidents.
• Validate and provide feedback on findings from the AI Alert Triage and Investigation Agent, helping tune agent logic and strengthen the handoff between autonomous triage and human-led response.
• Lead incident command for significant and multi-system incidents, coordinating with Cyber Defense Engineering, Cyber Threat Intelligence, Advanced Threat Operations, IT, and business stakeholders as needed.
• Exercise significant independent judgment to scope, prioritize, and direct the response strategy for complex or ambiguous incidents escalated from automated detection.
• Own and lead investigations into insider risk and fraud cases end to end, partnering with Insider Threat Engineering, Legal, and HR on findings and remediation.
• Define, mature, and lead continuous improvement of the incident response SOPs, runbooks, and playbooks that set the standard for the broader team.
• Author detailed root cause analyses and lessons-learned reports for significant incidents, and present findings and remediation recommendations to engineering and leadership.
• Partner with Advanced Threat Operations on complex, multistage investigations requiring forensic analysis, threat hunting, or malware reverse engineering, contributing incident context and supporting coordinated remediation.
• Build trusted partnerships with Cyber Defense Engineering, translating incident findings into improved detection content, data quality, and SIEM onboarding.
• Partner with Cyber Threat Intelligence to incorporate adversary TTPs and indicators into active investigations and influence detection priorities.
• Mentor and develop other incident responders within the Threat Management Center, building technical capability and response consistency across the team.

What you'll need

• 5+ years of hands-on experience in incident response, with demonstrated ownership of investigations from detection through recovery.
• Demonstrated experience leading incident command for complex, multi-system security incidents, coordinating response across technical and business stakeholders.
• Deep understanding of attacker tactics, techniques, and procedures, and the MITRE ATT&CK framework, applied to real-world investigations.
• Experience conducting end-to-end investigations in a SIEM or XDR platform (Google SecOps/Chronicle, Splunk, Microsoft Sentinel, or similar), correlating evidence across endpoint, network, cloud, and identity telemetry.
• Proven ability to define and mature incident response SOPs, runbooks, and playbooks adopted across a security team.
• Experience mentoring other incident responders or security analysts and developing technical capability within a function.
• Experience investigating insider risk or fraud cases involving coordination with Legal, HR, and business stakeholders.
• Excellent written and verbal communication skills, including the ability to present root cause analysis and recommendations to technical and executive audiences.
• Working knowledge of AI and AI agents, including how agentic SOC capabilities perform automated alert triage and investigation, and the ability to evaluate, validate, and provide feedback on AI-generated findings.

Details

• Full-time position.
• Work generally Monday through Friday, with required participation in a rotating on-call schedule for significant incidents outside business hours, including nights, weekends, and holidays.
• Up to 10% domestic and international travel may be required, including team meetings, training events, leadership workshops, cybersecurity conferences, and operational reviews.
• Hybrid role with in-office expectations determined by location and subject to change based on evolving business needs.