{"id":2514149,"url":"https://alion.io/job/wursta-lead-security-operations-analyst","title":"Lead Security Operations Analyst","company":{"id":4416895,"name":"The Wursta Corporation","domain":"wursta.com","url":"https://alion.io/company/wursta","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["El Salvador"],"countries":["SV"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":101000,"max_usd":261000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":623},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Amazon CloudWatch","optional":false},{"name":"Anthropic","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"BigQuery","optional":false},{"name":"Claude","optional":false},{"name":"Commander.js","optional":false},{"name":"Copilot","optional":false},{"name":"Cortex","optional":false},{"name":"Cortex XDR","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Cursor","optional":false},{"name":"DNS","optional":false},{"name":"Docker","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"Falcon","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"Gemini","optional":false},{"name":"Go","optional":false},{"name":"Google BigQuery","optional":false},{"name":"IAM","optional":false},{"name":"LangChain","optional":false},{"name":"LLM","optional":false},{"name":"Machine Learning","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"NIST CSF","optional":false},{"name":"Node JS","optional":false},{"name":"Okta","optional":false},{"name":"OpenAI","optional":false},{"name":"Pandas","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Rest API","optional":false},{"name":"SentinelOne","optional":false},{"name":"Shuffle","optional":false},{"name":"SIEM","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"Splunk","optional":false},{"name":"Suricata","optional":false},{"name":"Tines","optional":false},{"name":"Windows","optional":false},{"name":"Wireshark","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"Zeek","optional":false},{"name":"Google Workspace","optional":true},{"name":"JavaScript","optional":true},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-09-29T16:55:57Z","employer_posted_date":"2026-09-29","last_verified_at":"2026-10-15T19:14:23Z","board_verified":true,"closed_at":null,"days_open":16,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":16},"description":"At Wursta, we believe technology should expand what people are capable of - not quietly erase what they are for. Buying the technology is the easy part; Wursta builds the operating system that turns technology investment into value you can measure - combining governance, workforce proficiency, and platform delivery, and then transferring the system to our clients' own teams. We specialize in digital transformation, cloud services, managed services, custom development, cybersecurity, and AI solutions to help organizations scale capabilities and increase productivity.\nWhy Wursta?\nAt Wursta, we hire motivated, inspired people and give them autonomy, training, and resources to solve problems for our clients and deliver excellent results. We focus on generating value and are obsessed with internal and external improvement and growth. And our results speak for themselves; we are forging a new breed of consultants and technical experts in the enterprise cloud industry that combine strong technical know-how with ingenuity and effective process improvements.\nThis position is based in Quito, Ecuador or El Salvador in a hybrid environment.\nAbout The Team\nThe Managed Security Services Operations (MSSP) Team functions as a Secure AI Augmented SOC, Software Engineering (AI Product Development), and Go-To-Market for Security services (Sales Enablement). This team functions within a specialized, cross-functional MSSP unit tailored for multi-tenant cloud environments (focusing on Google Workspace and Google Cloud Platform).\nThe team is structured to operate as a high-velocity, automation-first security team, moving away from traditional manual Level 1/Level 2 SOC escalation trees to an AI-driven, Tier-3 led model.\nKey Responsibilities\nThe Lead Security Operations Analyst serves a dual-purpose operational and engineering role. As the primary tier-3 response authority and team lead, this individual oversees real-time threat monitoring, incident response, and SLA delivery across client tenants within the proprietary MSSP platform.\nSimultaneously, this role acts as an AI Integration and Detection Engineer, leveraging modern AI development tools (e.g., Google Gemini and Anthropic Claude API) to architect automated escalation workflows and orchestrations, engineer high-fidelity detections, and integrate custom AI agents into the core MSSP application stack.\n1. Security Monitoring & Incident Response (24/7 Operations Lead)\nThreat Detection & Triage: Lead the operational triage, analysis, and prioritization of complex security events across multi-tenant client environments.\n\nIncident Response Leadership: Function as the Incident Commander during critical security events, adhering strictly to NIST SP 800-61r2 (Computer Security Incident Handling Guide) to execute containment, eradication, and recovery strategies.\n\nThreat Hunting & Detection Engineering: Utilize the MITRE ATT&CK Framework to map adversary tactics, techniques, and procedures (TTPs), proactive threat hunting, and writing custom correlation rules (e.g., Sigma, YARA).\n\nClient Advisory & SLA Enforcement: Ensure all incident notifications and responses meet contractual Service Level Agreements (SLAs) and regulatory reporting timelines.\n\n2. MSSP App Automation & AI Development\nAI-Assisted Workflow Engineering: Utilize AI development environments and APIs to write clean, production-grade Python, Node.js, or Go code to extend the backend logic of the MSSP application.\n\nThird Party Tool Integrations: As needed, build integrations to meet Client needs for monitoring other security solution telemetry such as EDR solutions (CrowdStrike, SentinalOne, Etc), DNS Security Alerts, Threat Intelligence (GTI, etc), SPAM/Phishing solutions, IDM solutions (Okta, Jumpcloud, etc), Firewall/IDS alerts, and other related monitoring needs.\n\nAutomated Escalation Playbooks: Design and build automated orchestration playbooks (SOAR) within the MSSP platform to execute dynamic triage, identity enrichment, and automatic tenant isolation.\n\nLLM & AI Integration: Implement AI-driven alert summarize-and-enrichment pipelines using LLM frameworks (e.g., Gemini models for internal threat databases, BigQuery SIEM data lakes, and third-party APIs via REST webhooks to construct dynamic Retrieval-Augmented Generation (RAG) pipelines, and MCP servers) to provide context-rich incident tickets for analysts and end-clients.\n\nNoise Reduction: Continuously optimize detection pipelines using machine learning and AI filters to reduce false positive alert volume.\n\n3. Compliance, Governance & Multi-Tenant Architecture\nFramework Alignment: Understanding of security monitoring controls directly to NIST CSF 2.0 (Detect/Respond), ISO/IEC 27001:2022 Control A.8.16 (Monitoring Activities), and NIST SP 800-53r5 controls (AU, IR, and SI families).\n\nData Privacy Compliance: Ensure incident response procedures and telemetry collection strictly adhere to EU GDPR (Article 33 notification obligations), Brazil LGPD, and US State Privacy Laws (CCPA/CPRA).\n\nRequired Skills\nCandidates must have experience in at least one of the following for each category.\nSIEM & XDR Platforms: Splunk, Microsoft Sentinel, Elastic SIEM, CrowdStrike Falcon, SentinelOne, Palo Alto Cortex XDR.\n\nNetwork & Telemetry: Wireshark, Zeek, Suricata, PCAP analysis, Syslog, Windows Event Logs, CloudTrail/CloudWatch.\n\nAI & Automation Tools: Python (Pandas, Requests), REST APIs, Cursor IDE, GitHub Copilot, Claude/OpenAI APIs, LangChain, Webhooks, Docker.\n\nSOAR & Scripting: Python, PowerShell, Bash, Demisto/Cortex XSOAR, Shuffle, Tines.\n\nThreat Frameworks: MITRE ATT&CK (Enterprise, Cloud), NIST SP 800-61r2, Cyber Kill Chain, YARA, Sigma Rules.\n\nCloud Environments: AWS, Azure, GCP security architectures, IAM, and log architectures.\n\nPreferred Qualifications\n3+ years in a SOC or MSSP environment with at least 2+ years in a Level 3 / Lead SOC capacity.\n\nProven hands-on experience in scripting and API integration to build automated incident response playbooks.\n\nDemonstrated proficiency using AI-assisted coding tools (e.g., Cursor, Copilot) to build, refactor, and deploy automation scripts and lightweight applications rapidly.\n\nExpertise in log analysis across endpoint, identity (Okta, Azure AD), network, and multi-cloud environments.\n\nRequired Certifications, at least one of the following;\nGIAC: GIAC Certified Incident Handler (GCIH), GIAC Continuous Monitoring & Security Operations (GMON), or GIAC Network Forensics Analyst (GNFA).\n\nCompTIA / Offensive Security: CySA+, CASP+, or OSCP.\n\nPreferred Certifications\nISC2: Certified Information Systems Security Professional (CISSP).\n\nInterview Process\nAt Wursta, we're all about positive experiences and creating value. We move fast and adapt to change like nobody's business. Here's what you can expect:\nWork Style Survey: A brief survey to help us learn more about your work style.\n\nInitial Screen: A 20-30 minute chat with our hiring coordinator to see if we’re a good fit.\n\nMeet your Manager: A 45-minute deep dive into the role and team with the hiring manager.\n\nMeet your Peers: A 60-minute session with the team to see the dynamic and ask questions.\n\nInterview with Senior Leadership: A 45-minute conversation with an executive leader regarding skills and company vision.\n\nGet a Decision: We typically get back to you within the week regarding next steps.\n\nEqual Employment Opportunity\nWursta provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.","description_format":"text","description_chars":7788,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Ecuador","iso":"EC","kind":"country"},{"name":"El Salvador","iso":"SV","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-10-14T09:31:50Z"}],"visa":[],"liveness":{"score":67,"band":"ok","label":"Likely open","p_open":1,"p_active":0.744,"p_room":0.9,"age_days":15,"expected_fill_days":24,"reasons":["conf:2","win:mid"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/wursta-lead-security-operations-analyst","json_url":"https://alion.io/job/wursta-lead-security-operations-analyst.json","meta":{"generated_at":"2026-10-15T19:59:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30329,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4416895},"rest":"https://alion.io/mcp/rest/get_company?id=4416895"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fwursta-lead-security-operations-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fwursta-lead-security-operations-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fwursta-lead-security-operations-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/wursta-lead-security-operations-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fwursta-lead-security-operations-analyst"}]}