{"id":2516835,"url":"https://alion.io/job/pfizer-lead-threat-response-operations-analyst","title":"Lead Threat Response Operations Analyst","company":{"id":3480,"name":"Pfizer","domain":"pfizer.com","url":"https://alion.io/company/pfizer","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sandwich, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":134000,"max_usd":235000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":20},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Carbon Black","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Google SecOps","optional":false},{"name":"Kali Linux","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"REMnux","optional":false},{"name":"SIEM","optional":false},{"name":"Snort","optional":false},{"name":"Splunk","optional":false},{"name":"TCP/IP","optional":false},{"name":"VMWare","optional":false},{"name":"Volatility","optional":false},{"name":"Windows","optional":false},{"name":"Wireshark","optional":false}],"status":"live","first_seen_at":"2026-10-14T09:59:43Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-18T20:16:11Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"ROLE SUMMARY\nOur Global Cyber Defense team is responsible for safeguarding Pfizer's digital assets and infrastructure through proactive threat detection, incident response, and risk mitigation across on-premises, cloud, and hybrid environments.\nAs a Lead Threat Response Operations Analyst within Pfizer’s Global Cyber Defense organization, you will serve as a senior individual contributor, providing technical leadership for the investigation and response to sophisticated cyber threats. While this is not a people-management role, you will lead complex investigations, coordinate the response to security incidents on a global scale, and provide technical guidance to analysts and partner teams. You will bring deep expertise in cyber threat analysis, incident response, malware investigations and adversary tradecraft, with the ability to operate confidently across complex business and technical environments.\nWorking alongside Threat Detection, Digital Forensics, Security Engineering and other partner teams, you will identify, contain and eradicate threats while providing strategic recommendations to strengthen Pfizer’s cyber resilience.\nROLE RESPONSIBILITIES\nCorrelate and analyse security telemetry from endpoint, identity, network, cloud, email and threat intelligence sources to identify, investigate and respond to malicious activity.\nApply knowledge of adversary tactics, techniques and procedures (TTPs) to reconstruct attack lifecycles, determine attack pathways, identify root cause and develop strategic detection and mitigation recommendations.\nLead the assessment of cyber security incidents, determining severity, business impact, threat scope, and appropriate response and escalation actions.\nApply advanced knowledge of networking, operating systems and security architectures to analyse technical evidence, identify attack vectors and guide effective containment, eradication and remediation actions.\nCommunicate complex technical findings, incident impacts, response decisions and remediation recommendations clearly to technical teams, business stakeholders and senior leadership.\nDrive continuous improvement of Threat Response processes, investigation methodologies, operational procedures, reporting standards, and playbooks to enhance the effectiveness and maturity of the cyber incident response capability\nCo-ordinate effectively across technical and business teams to coordinate cyber incident response activities, maintaining professionalism and sound judgement during high-pressure situations.\nLead complex cyber security projects and cross-functional workstreams, ensuring timely delivery of objectives and operational improvements. Support the triage of cyber security tickets, providing technical guidance on priority, scope, investigation, escalation and appropriate response actions.\nProvide technical guidance, coaching and knowledge sharing to analysts and partner teams to strengthen investigation quality and Threat Response capability.\nParticipate in a scheduled on-call rotation, including weekends, providing timely response, investigation, escalation, and coordination of cyber security incidents.\nMaintain and continuously develop technical expertise in cyber security, threat response, and emerging attack techniques through ongoing training, research, and professional development.\nBASIC QUALIFICATIONS\nBachelor’s degree in cyber security, computer forensics, computer science, Information Security, Information Systems, Engineering, Sciences or related field.\nSome relevant experience in cyber security operations, incident response or threat investigation, with demonstrated experience leading complex investigations.\nAdvanced understanding of TCP/IP, network protocols and traffic flows, operating systems, cloud and identity technologies, enterprise security architectures and defence-in-depth principles.\nAdvanced knowledge of Windows operating systems, system administration, security controls, native utilities and investigative artefacts.\nDemonstrated ability to analyse and correlate large volumes of security log data using security information and event management (SIEM) platforms, such as CrowdStrike Falcon Next-Gen SIEM, Splunk, Google SecOps and draw accurate, evidence-based conclusions.\nExperience using endpoint detection and response (EDR) platforms, such as CrowdStrike Falcon, Microsoft Defender for Endpoint or VMware Carbon Black, to investigate malicious activity, analyse endpoint telemetry and support incidentcontainment and remediation.\nExperience using security analysis and investigation tools such as Wireshark, Snort, Splunk, Kali Linux, SIFT Workstation, REMnux and Volatility or comparable commercial and open-source technologies, including tools used for memory forensics and malware analysis.\nAdvanced understanding of the life cycle of network threats, attacks, attack vectors and methods of exploitation with an understanding of intrusion set tactics, techniques and procedures (TTPs)\nDemonstrated ability to analyse and resolve complex technical problems, working independently and collaboratively within cross-functional teams.\nMaintain and continuously develop technical expertise in cyber security, threat response and emerging attack techniques through ongoing training, research and professional development.\nStrong written, verbal and interpersonal communication skills, together with demonstrated organisational and planning abilities and the capacity to coordinate multiple complex investigations and workstreams simultaneously.\nExcellent communication and presentation skills with the ability to present to a variety of internal audiences including senior executives.\nDemonstrated experience leading and delivering complex cyber security projects and cross-functional workstreams, achieving both short-term objectives and longer-term operational improvements.\nPractical experience using the Linux command line to support security investigations, data analysis and the operation of cyber security tools.\nPreferred qualification:\nParticipation in practical cyber security exercises, such as red team and blue team simulations, capture-the-flag challenges, cyber ranges or incident response exercises.\nExperience using scripting or programming languages, such as Python or PowerShell, to support security investigations, analyse security data and automate repetitive tasks.\nWork Location Assignment: Hybrid\nPurpose\nBreakthroughs that change patients' lives... At Pfizer we are a patient centric company, guided by our four values: courage, joy, equity and excellence. Our breakthrough culture lends itself to our dedication to transforming millions of lives.\nDigital Transformation Strategy \nOne bold way we are achieving our purpose is through our company wide digital transformation strategy. We are leading the way in adopting new data, modelling and automated solutions to further digitize and accelerate drug discovery and development with the aim of enhancing health outcomes and the patient experience.\nFlexibility \nWe aim to create a trusting, flexible workplace culture which encourages employees to achieve work life harmony, attracts talent and enables everyone to be their best working self. Let’s start the conversation!\nEqual Employment Opportunity\nWe believe that a diverse and inclusive workforce is crucial to building a successful business. As an employer, Pfizer is committed to celebrating this, in all its forms - allowing for us to be as diverse as the patients and communities we serve. Together, we continue to build a culture that encourages, supports and empowers our employees.\nDisAbility Confident\nWe are proud to be a Disability Confident Employer and we encourage you to put your best self forward with the knowledge and trust that we will make any reasonable adjustments necessary to support your application and future career. Our mission is unleashing the power of our people, especially those with unique superpowers. Your journey with Pfizer starts here!\nTo learn more about acceptable and prohibited uses of AI during the recruitment process, please review our candidate AI-use guidelines available on Pfizer Careers.\nInformation & Business Tech","description_format":"text","description_chars":8180,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible schedule","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Prescription Drugs","Information Security","Oncology Therapeutics","Infectious Disease Therapeutics"],"lifecycle":[{"event":"open","at":"2026-10-14T09:59:43Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":29,"reasons":["conf:1","velocity","win:early","comp:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/pfizer-lead-threat-response-operations-analyst","json_url":"https://alion.io/job/pfizer-lead-threat-response-operations-analyst.json","meta":{"generated_at":"2026-10-18T21:56:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25184,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3480},"rest":"https://alion.io/mcp/rest/get_company?id=3480"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fpfizer-lead-threat-response-operations-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fpfizer-lead-threat-response-operations-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fpfizer-lead-threat-response-operations-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/pfizer-lead-threat-response-operations-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fpfizer-lead-threat-response-operations-analyst"}]}