{"id":2491588,"url":"https://alion.io/job/trupanion-cybersecurity-analyst","title":"Cybersecurity Analyst","company":{"id":7711,"name":"Trupanion","domain":"trupanion.com","url":"https://alion.io/company/trupanion","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":75,"open_postings":19,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":27,"computed_at":"2026-10-14T06:34:16Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Seattle, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":120000,"max":140000,"currency":"USD","period":"year","gross":null,"usd_annual":140000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":true,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Azure","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"Platform Engineering","optional":false},{"name":"SIEM","optional":false},{"name":"SLI/SLO/SLA","optional":false}],"status":"live","first_seen_at":"2026-10-13T23:55:21Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-14T08:23:39Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Trupanion is a leading provider of medical insurance for cats and dogs in North America. Our mission is to help loving, responsible pet owners budget and care for their pets. At Trupanion, we offer a collaborative, casual, and pet-friendly environment where everyone is encouraged to be themselves.\n The Cybersecurity Analyst supports day-to-day Security Operations and Incident Response by monitoring and investigating threats, coordinating incident response, conducting threat intelligence and threat hunting, managing operational vulnerability workflows, and maintaining accurate cases and security metrics. Security Engineering owns security-platform engineering and vulnerability-scanning platforms, while technology and application owners execute remediation.\nThis position is open to candidates in the Seattle, WA area. You will have a hybrid remote/in-office schedule where you will work from our casual, pet-friendly office at least 3 days a week.\nResponsibilities:\nSecurity Monitoring & Incident Response\nMonitor and triage alerts across identity, endpoint, email, network, cloud, application, vulnerability, and data-protection technologies. \nValidate, enrich, classify, and prioritize security events and investigate phishing, account compromise, malware, ransomware, unauthorized access, data exposure, insider threat, and third-party events. \nExecute approved containment actions within assigned permissions and coordinate infrastructure-level or production changes with Technology Operations. \nCollect and preserve evidence, identify affected users, devices, accounts, systems, repositories, and data, and support eradication, recovery validation, heightened monitoring, and closure. \nThreat Intelligence & Threat Hunting\nCollect and evaluate intelligence from commercial, government, industry, open-source, MDR, vendor, and internal sources. \nAnalyze threat actors, campaigns, tactics, techniques, procedures, indicators, exploited vulnerabilities, and targeted technologies for relevance to Trupanion. \nCreate tactical and operational intelligence products and operationalize findings through investigations, detections, hunting queries, watchlists, blocking actions, phishing simulation scenarios, and runbook updates. \nConduct hypothesis-driven hunts across identity, endpoint, email, network, cloud, and application telemetry using MITRE ATT&CK and document scope, queries, evidence, findings, and follow-up actions. \nVulnerability Management Partnership\nValidate vulnerability findings, assess risk and business exposure, prioritize remediation using threat intelligence and incident telemetry, identify indications of exploitation, and escalate urgent vulnerabilities. \nPerform threat hunts against affected technologies and recommend temporary containment or monitoring when active exploitation or incident correlation is identified. \nPartner with Security Engineering, which owns vulnerability-scanning platforms, integrations, technical configuration, and platform reliability. \nCoordinate remediation assignments with technology and application owners, maintain the vulnerability ticket flow, track progress against defined service levels, report overdue exposure, and escalate ownership or delivery issues through the established governance process. \nMaintain operational oversight of vulnerability validation, prioritization, ticketing, remediation follow-up, SLA reporting, and escalation; remediation execution remains with the technology or application owner responsible for the affected asset or service. \nAutomation, Forensics & Case Management\nDevelop and maintain approved automation workflows, scripts, and playbooks for alert enrichment, investigation, authorized response, and case consistency. \nPreserve identity, endpoint, email, cloud, network, application, and audit-log evidence under approved forensic, legal-hold, integrity, and chain-of-custody procedures. \nMaintain complete case records covering severity, affected assets, evidence, analysis, actions, decisions, communications, and closure rationale. \nValidate incident containment and corrective actions through available telemetry, testing, or monitoring. \nBreach, Identity, Third-Party & AI Investigations\nSupport breach investigations by identifying affected repositories, records, data types, individuals, business entities, and jurisdictions for Legal and Privacy review. \nInvestigate token theft, MFA changes, privilege escalation, malicious application consent, mailbox manipulation, and compromised user, privileged, service-principal, or workload identities. \nInvestigate third-party, supply-chain, and AI-related security notifications or suspected misuse and document potential Trupanion exposure. \nOperating Model & Continuity\nExecute alert triage, investigations, MDR service monitoring, threat-intelligence analysis, threat hunting, vulnerability validation and prioritization, remediation follow-up, security metrics and reporting, case documentation, and authorized security-tool actions. \nEscalate architecture, complex integration, detection-platform design, routine vulnerability-management administration, and permanent engineering needs to Security Engineering. \nProvide structured handovers of active alerts, incidents, intelligence, investigations, and urgent exploitation-driven vulnerability exposures across operating regions. \nProvide technical evidence to Legal and Privacy and do not independently determine legal privilege, regulatory interpretation, or notification obligations. \nQualifications:\nBachelor’s degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or a related field, or equivalent practical experience. \n3+ years of experience in cybersecurity operations, incident response, IT operations, system administration, network security, or a related area. \nExperience investigating alerts using SIEM, EDR/XDR, identity, email, cloud, network, or vulnerability technologies. \nKnowledge of common attacker techniques, phishing, malware, account compromise, privilege misuse, lateral movement, exfiltration, and vulnerability exploitation. \nDemonstrated experience applying threat intelligence and incident telemetry to vulnerability prioritization and exploitation assessment. \nExperience with security automation or scripting, digital-evidence handling, identity investigations, third-party incident analysis, and structured case management. \nSkills:\nExperience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments. \nFamiliarity with MITRE ATT&CK and common detection, threat-hunting, and incident-response methodologies. \nUnderstanding of vulnerability scanning and remediation workflows and the division of responsibility between vulnerability-program governance, threat-led escalation, and asset-owner remediation. \nKnowledge of NIST CSF, ISO 27001, PCI DSS, NYDFS cybersecurity requirements, or privacy and breach-response obligations. \nRelevant certification such as Security+, CySA+, SC-200, GCIH, GCIA, or equivalent experience is preferred. \nAdditional Requirements:\nAbility to support defined US business-hour coverage and participate in an escalation or on-call rotation. \nAvailability to assist with high-severity incidents outside normal working hours when required. \nAbility to handle confidential, legally sensitive, and security-restricted information appropriately.\nCompensation:\nThe base salary range for this position is $120,000 - $140,000 on a full-time schedule. \nAlong with base compensation, Trupanion employees are currently eligible for monthly bonuses. \nWe want all employees to be invested in Trupanion’s success, so we grant Restricted Stock Units to all new team members. Our new hire grants vest over 4 years. \nBenefits and Perks:\nFull medical, dental, and vision benefits at no cost to the employee\nFour weeks of paid time off and 9 paid float holidays (you can decide which days are most important to you!)\nFive-week sabbatical after five years of employment\nOpen, casual, pet-friendly, and fun office environment\nFree medical health insurance for your pet (1 dog or cat)\nPaid time off to volunteer at nonprofit organizations\nSeattle Office Amenities: Free on-site gym, free dog walking services for office pets during business hours, free parking, and paid ORCA cards.\nFor more information about Trupanion, visit https://trupanion.com/about\nLearn more about how Trupanion has revolutionized our industry and the reimbursement model: https://www.youtube.com/watch?v=vdWZ4KHiPTQ\nTrupanion is an equal-opportunity employer and embraces diversity. We are committed to building a team that represents a variety of backgrounds, abilities, perspectives, and skills.\nWe will ensure that individuals are provided reasonable accommodation to participate in the job application or interview process, perform essential job functions, and receive other benefits and privileges of employment. Please contact us to request accommodations.\nApplicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment visa at this time.","description_format":"text","description_chars":9184,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Health insurance","Restricted stock units"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Property & Casualty Insurance"],"lifecycle":[{"event":"open","at":"2026-10-14T02:50:50Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":0,"expected_fill_days":27,"reasons":["conf:3","stale_co","win:early"],"computed_at":"2026-10-14T06:34:16Z"},"pay":{"stated_usd_annual":140000,"is_top_pay":true},"html_url":"https://alion.io/job/trupanion-cybersecurity-analyst","json_url":"https://alion.io/job/trupanion-cybersecurity-analyst.json","meta":{"generated_at":"2026-10-14T12:11:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14809,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7711},"rest":"https://alion.io/mcp/rest/get_company?id=7711"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftrupanion-cybersecurity-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftrupanion-cybersecurity-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftrupanion-cybersecurity-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/trupanion-cybersecurity-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftrupanion-cybersecurity-analyst"}]}