Security Analyst (Cyber Defense Analyst)

AHEAD is seeking an experienced Cyber Defense Analyst to join the AHEAD Corporate Security Cyber Defense team. This position contributes to the successful delivery of AHEAD’s information security program in order to assure AHEAD stakeholders of strong operating controls and effective defensive capabilities.

The Cyber Defense Analyst is responsible for monitoring, triaging, investigating, and reporting on security events across the enterprise, with a strong emphasis on CrowdStrike Falcon, CrowdStrike NG-SIEM, detection engineering, and response automation. A typical day will include owning escalated investigations, correlating endpoint, identity, email, cloud, and application telemetry, creating or tuning detections, developing scripts and workflows, supporting incident response, and improving the team's operational capabilities. This is a hands-on position for an analyst who can independently investigate complex security events, develop and improve detections, and build automation that makes security operations faster, more consistent, and more effective.

Reporting directly to Corporate Security leadership, the ideal candidate is a professional, collaborative team player who can communicate clearly during high-impact investigations, and partner effectively with technical teams and business stakeholders. The analyst is also expected to share knowledge, improve repeatable processes, and help raise the technical capability of the broader Cyber Defense team.

Responsibilites:

• Independently monitor, triage, and investigate security alerts and escalations across endpoint, identity, email, network, cloud, and application telemetry; determine severity, scope, business impact, and required response.
• Create, tune, and maintain NG-SIEM searches, dashboards, alerts, parsers, and detections; improve alert fidelity, reduce false positives, add meaningful context, and close visibility gaps identified during investigations or threat hunts.
• Design and implement automation for alert enrichment, investigation support, ticket creation and updates, evidence collection, reporting, notification, and approved response or remediation actions using Python, PowerShell, APIs, and security-platform workflows.
• Measure and communicate automation outcomes, including reduced manual effort, faster triage or response, improved consistency, increased coverage, and operational safeguards such as logging, error handling, testing, and human approval points.
• Conduct proactive threat hunting and threat research across CrowdStrike, NG-SIEM, Microsoft 365, identity, cloud, and other enterprise data sources to identify emerging risks and adversary behavior.
• Lead or materially support incident response activities, including containment recommendations, scoping, root-cause analysis, evidence preservation, remediation tracking, lessons learned, and post-incident detection improvements.
• Support the reliability and effectiveness of core Cyber Defense technologies by identifying telemetry, parsing, integration, configuration, and data-quality issues and driving them to resolution.
• Develop and refine incident response playbooks, automation workflows, operating procedures, and quality controls; mentor or provide technical guidance to less-experienced analysts on investigations and tooling.
• Partner with infrastructure teams and system owners to validate vulnerability findings, prioritize remediation based on exploitability and business risk, and use automation or reporting improvements to track high-risk issues through closure.

Qualifications:

• 5+ years of information security experience, including 3+ years in enterprise security operations, incident response, detection engineering, or cyber defense.
• Hands-on experience with enterprise EDR and SIEM platforms; CrowdStrike Falcon and CrowdStrike NG-SIEM experience strongly preferred.
• Experience creating and tuning detections, reducing false positives, and improving detection coverage.
• Experience automating security operations with Python, PowerShell, APIs, SOAR, or other workflow platforms.
• Strong investigation, incident response, documentation, and communication skills across endpoint, identity, email, network, and cloud environments.
• Familiarity with MITRE ATT&CK, NIST CSF, CIS Controls, or similar frameworks, plus vulnerability management experience with tools such as Tenable or Wiz.

Certifications:

• Bachelor's Degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field
• CCSP, GCIH, CySA+, GSEC, SSCP or similar cybersecurity certification required