{"id":104776,"url":"https://alion.io/job/ahead-security-analyst-cyber-defense-analyst","title":"Security Analyst (Cyber Defense Analyst)","company":{"id":3614,"name":"AHEAD","domain":"ahead.com","url":"https://alion.io/company/ahead","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":75,"open_postings":40,"ghost_share":0,"stale_share":0.8,"repost_share":0,"time_to_fill_p50_days":78,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":19500,"max_usd":43000,"period":"year","method":"role_seniority_country_cell","sample_n":13},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Crowdstrike","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-06-11T07:52:20Z","employer_posted_date":"2026-06-11","last_verified_at":"2026-10-30T16:41:51Z","board_verified":true,"closed_at":null,"days_open":141,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":141},"description":"AHEAD is seeking an experienced Cyber Defense Analyst to join the AHEAD Corporate Security Cyber Defense team. This position contributes to the successful delivery of AHEAD’s information security program in order to assure AHEAD stakeholders of strong operating controls and effective defensive capabilities.\nThe Cyber Defense Analyst is responsible for monitoring, triaging, investigating, and reporting on security events across the enterprise, with a strong emphasis on CrowdStrike Falcon, CrowdStrike NG-SIEM, detection engineering, and response automation. A typical day will include owning escalated investigations, correlating endpoint, identity, email, cloud, and application telemetry, creating or tuning detections, developing scripts and workflows, supporting incident response, and improving the team's operational capabilities. This is a hands-on position for an analyst who can independently investigate complex security events, develop and improve detections, and build automation that makes security operations faster, more consistent, and more effective.\nReporting directly to Corporate Security leadership, the ideal candidate is a professional, collaborative team player who can communicate clearly during high-impact investigations, and partner effectively with technical teams and business stakeholders. The analyst is also expected to share knowledge, improve repeatable processes, and help raise the technical capability of the broader Cyber Defense team.\nResponsibilites:\nIndependently monitor, triage, and investigate security alerts and escalations across endpoint, identity, email, network, cloud, and application telemetry; determine severity, scope, business impact, and required response.\nCreate, tune, and maintain NG-SIEM searches, dashboards, alerts, parsers, and detections; improve alert fidelity, reduce false positives, add meaningful context, and close visibility gaps identified during investigations or threat hunts.\nDesign and implement automation for alert enrichment, investigation support, ticket creation and updates, evidence collection, reporting, notification, and approved response or remediation actions using Python, PowerShell, APIs, and security-platform workflows.\nMeasure and communicate automation outcomes, including reduced manual effort, faster triage or response, improved consistency, increased coverage, and operational safeguards such as logging, error handling, testing, and human approval points.\nConduct proactive threat hunting and threat research across CrowdStrike, NG-SIEM, Microsoft 365, identity, cloud, and other enterprise data sources to identify emerging risks and adversary behavior.\nLead or materially support incident response activities, including containment recommendations, scoping, root-cause analysis, evidence preservation, remediation tracking, lessons learned, and post-incident detection improvements.\nSupport the reliability and effectiveness of core Cyber Defense technologies by identifying telemetry, parsing, integration, configuration, and data-quality issues and driving them to resolution.\nDevelop and refine incident response playbooks, automation workflows, operating procedures, and quality controls; mentor or provide technical guidance to less-experienced analysts on investigations and tooling.\nPartner with infrastructure teams and system owners to validate vulnerability findings, prioritize remediation based on exploitability and business risk, and use automation or reporting improvements to track high-risk issues through closure.\nQualifications:\n5+ years of information security experience, including 3+ years in enterprise security operations, incident response, detection engineering, or cyber defense.\nHands-on experience with enterprise EDR and SIEM platforms; CrowdStrike Falcon and CrowdStrike NG-SIEM experience strongly preferred.\nExperience creating and tuning detections, reducing false positives, and improving detection coverage.\nExperience automating security operations with Python, PowerShell, APIs, SOAR, or other workflow platforms.\nStrong investigation, incident response, documentation, and communication skills across endpoint, identity, email, network, and cloud environments.\nFamiliarity with MITRE ATT&CK, NIST CSF, CIS Controls, or similar frameworks, plus vulnerability management experience with tools such as Tenable or Wiz.\nCertifications:\nBachelor's Degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field\nCCSP, GCIH, CySA+, GSEC, SSCP or similar cybersecurity certification required","description_format":"text","description_chars":4574,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","C4ISR","Information Security","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-06-11T07:52:20Z"}],"visa":[],"liveness":{"score":16,"band":"cold","label":"Long shot","p_open":1,"p_active":0.441,"p_room":0.36,"age_days":140,"expected_fill_days":78,"reasons":["conf:2","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/ahead-security-analyst-cyber-defense-analyst","json_url":"https://alion.io/job/ahead-security-analyst-cyber-defense-analyst.json","meta":{"generated_at":"2026-10-30T19:21:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8655,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3614},"rest":"https://alion.io/mcp/rest/get_company?id=3614"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fahead-security-analyst-cyber-defense-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fahead-security-analyst-cyber-defense-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fahead-security-analyst-cyber-defense-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ahead-security-analyst-cyber-defense-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fahead-security-analyst-cyber-defense-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":104776}},{"tool":"search_jobs","arguments":{"company":"ahead.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":104776},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}