Cybersecurity Analyst

Trupanion is hiring a Cybersecurity Analyst to strengthen day-to-day Security Operations and Incident Response for the organization. This hybrid role in the Seattle, WA area focuses on monitoring and investigating threats, coordinating incident response activities, and advancing vulnerability workflows through threat-led validation and prioritization.

Role snapshot

• Monitor and triage alerts across identity, endpoint, email, network, cloud, application, vulnerability, and data-protection technologies.
• Validate, enrich, classify, and prioritize security events, then investigate activity such as phishing, account compromise, malware, ransomware, unauthorized access, data exposure, insider threat, and third-party events.
• Collect and preserve evidence, identify affected users, devices, accounts, systems, repositories, and data, and support actions such as eradication, recovery validation, heightened monitoring, and closure.
• Gather and evaluate intelligence from commercial, government, industry, open-source, MDR, vendor, and internal sources.
• Analyze threat actors, campaigns, tactics, techniques, procedures, indicators, exploited vulnerabilities, and targeted technologies for relevance to Trupanion.

Threat intelligence, hunting, and vulnerability operations

• Create tactical and operational intelligence products, and operationalize findings through investigations, detection and hunting queries, watchlists, blocking actions, phishing simulation scenarios, and runbook updates.
• Conduct hypothesis-driven hunts across identity, endpoint, email, network, cloud, and application telemetry using MITRE ATT&CK, documenting scope, queries, evidence, findings, and follow-up actions.
• Validate vulnerability findings, assess risk and business exposure, prioritize remediation using threat intelligence and incident telemetry, identify indicators of exploitation, and escalate urgent vulnerabilities.
• Perform threat hunts against affected technologies and recommend temporary containment or monitoring when active exploitation or incident correlation is identified.

Collaboration and case ownership

• Partner with Security Engineering, which owns vulnerability-scanning platforms, integrations, technical configuration, and platform reliability.
• Coordinate remediation assignments with technology and application owners, maintain the vulnerability ticket flow, track progress against defined service levels, report overdue exposure, and escalate ownership or delivery issues through established governance.
• Maintain operational oversight for vulnerability validation, prioritization, ticketing, remediation follow-up, SLA reporting, and escalation. Remediation execution remains with the technology or application owner responsible for the affected asset or service.
• Develop and maintain approved automation workflows, scripts, and playbooks for alert enrichment, investigation, authorized response, and case consistency.
• Maintain complete case records that include severity, affected assets, evidence, analysis, actions, decisions, communications, and closure rationale.
• Validate incident containment and corrective actions through available telemetry, testing, or monitoring.
• Support breach investigations by identifying affected repositories, records, data types, individuals, business entities, and jurisdictions for Legal and Privacy review.

Specific investigation focus areas

• Investigate token theft, MFA changes, privilege escalation, malicious application consent, mailbox manipulation, and compromised user, privileged, service-principal, or workload identities.
• Investigate third-party, supply-chain, and AI-related security notifications or suspected misuse, documenting potential exposure to Trupanion.
• Execute alert triage, investigations, MDR service monitoring, threat-intelligence analysis, threat hunting, vulnerability validation and prioritization, remediation follow-up, security metrics and reporting, case documentation, and authorized security-tool actions.
• Provide structured handovers of active alerts, incidents, intelligence, investigations, and urgent exploitation-driven vulnerability exposures across operating regions.

Evidence handling and legal coordination

• Preserve identity, endpoint, email, cloud, network, application, and audit-log evidence under approved forensic, legal-hold, integrity, and chain-of-custody procedures.
• Provide technical evidence to Legal and Privacy, without independently determining legal privilege, regulatory interpretation, or notification obligations.

Required qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or related field, or equivalent practical experience.
• 3+ years of experience in cybersecurity operations, incident response, IT operations, system administration, network security, or related area.
• Experience investigating alerts using SIEM, EDR/XDR, identity, email, cloud, network, or vulnerability technologies.
• Knowledge of common attacker techniques including phishing, malware, account compromise, privilege misuse, lateral movement, exfiltration, and vulnerability exploitation.
• Demonstrated experience applying threat intelligence and incident telemetry to vulnerability prioritization and exploitation assessment.
• Experience with security automation or scripting, digital-evidence handling, identity investigations, third-party incident analysis, and structured case management.
• Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments.
• Familiarity with MITRE ATT&CK and common detection, threat-hunting, and incident-response methodologies.
• Understanding of vulnerability scanning and remediation workflows, including the division of responsibility between vulnerability-program governance, threat-led escalation, and asset-owner remediation.
• Knowledge of NIST CSF, ISO 27001, PCI DSS, NYDFS cybersecurity requirements, or privacy and breach-response obligations.
• Relevant certification such as Security+, CySA+, SC-200, GCIH, GCIA, or equivalent experience is preferred.
• Ability to support defined US business-hour coverage and participate in an escalation or on-call rotation.
• Availability to assist with high-severity incidents outside normal working hours when required.
• Ability to handle confidential, legally sensitive, and security-restricted information appropriately.

Technologies you will work with

• SIEM, EDR/XDR, Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, MITRE ATT&CK, MDR, NIST CSF, ISO 27001, PCI DSS, NYDFS

Compensation and benefits

• Base salary range: $120,000 - $140,000 annually for a full-time schedule.
• Monthly bonuses are available in addition to base compensation.
• Restricted Stock Units (RSUs) for new team members, vesting over 4 years.
• Full medical, dental, and vision benefits at no cost to the employee.
• Four weeks of paid time off and 9 paid float holidays.
• Five-week sabbatical after five years of employment.
• Open, casual, pet-friendly office environment.
• Free medical health insurance for your pet (1 dog or cat).
• Paid time off to volunteer at nonprofit organizations.
• Seattle Office amenities: free on-site gym, free dog walking services for office pets during business hours, free parking, and paid ORCA cards.

Location and schedule

• Seattle, WA with a hybrid remote/in-office schedule.
• In-office attendance required at least 3 days per week at Trupanion’s casual, pet-friendly office.