Principal Security Analyst
Jul 2026 - Present
- Triage, investigate, and respond to security incidents from detection through resolution across an MDR operation covering 200+ customer environments, correlating evidence from 30+ integrated EDR, SIEM, identity, and network security products to determine scope, root cause, and required containment.
- Analyze endpoint, network, and log data directly within Cortex XDR, CrowdStrike Falcon, Microsoft Defender XDR, and SentinelOne to identify malicious activity and confirm attack techniques across customer environments.
- Execute live containment and remediation actions, including host isolation, credential resets, session revocation, email deletion, and file quarantine, through a dual authorization workflow that removes attacker access and malicious artifacts.
- Communicate investigation findings, response status, and remediation recommendations to customer stakeholders, documenting response actions and incident outcomes during high priority incidents across a 24x7 MDR operation with rotating overnight and weekend shift coverage.
- Maintain a 16 minute average time to investigation while handling 300+ alerts monthly, applying an in-house AI platform across triage, investigation, correlation, and incident documentation while validating all findings against source telemetry.
- Train and mentor L1 analysts on investigation workflow, AI platform usage, and client ready incident documentation.