Cybersecurity Analyst Tier 3

What we offer

Join the University of Utah Security Operations Center as a Senior Cybersecurity Analyst (Tier 3) on site in Salt Lake City. This full time role offers a competitive salary in the range of $100,000 - $195,795 per year and the chance to lead complex investigations, steer detection engineering, and drive automation across endpoint, network, cloud, and identity domains. You will collaborate with a skilled SOC team and influence incident response and proactive security across campus systems.

Responsibilities

• Oversee the complete incident response lifecycle across endpoints, networks, cloud, and identity, from triage through containment, eradication, and post incident analysis.
• Act as the senior escalation contact for Tier 2 analysts, providing technical direction and oversight for complex investigations.
• Perform digital forensics to support root-cause analysis, adjust detections to close gaps, and develop post-incident action plans.
• Own detection strategy and coverage across key threat domains, defining telemetry requirements with security engineering and platform owners.
• Lead the development of detection standards and quality metrics.
• Design and maintain detection logic across SIEM, EDR, and cloud platforms, ensuring high fidelity alerts through tuning, enrichment, and multi-source telemetry correlation.
• Identify detection gaps based on threat intelligence and the incident response lifecycle.
• Design, build, and maintain automation with SOAR to improve triage, data enrichment, and response efficiency.
• Operationalize threat hunting findings into scalable detection use cases and playbooks.
• Lead hypothesis-driven threat hunting campaigns informed by threat intelligence, turning findings into durable detections and response playbooks.
• Conduct proactive threat hunting to detect advanced adversarial activity not covered by existing controls.
• Analyze attacker behavior and map it to known tactics, techniques, and procedures (TTPs).
• Continuously evaluate detection coverage, reduce false positives, and improve detection quality.
• Assist in mentoring and developing Tier 1/2 SOC analysts and conduct periodic investigation reviews to ensure quality.
• Advance SOC processes, workflows, and incident response playbooks; produce clear after action reports and executive-ready summaries.
• Partner with internal IT teams to improve logging, telemetry, and observability across the environment.

Requirements

• Minimum experience: 6 years
• Education: Master’s degree or equivalent
• Equivalency statement: 1 year of higher education can substitute for 1 year of directly related work experience (example: a bachelor’s degree equals 4 years of related experience)
• Information Security Analyst, IV: bachelor’s (or equivalent) + 8 years or master’s (or equivalent) + 6 years
• Information Security Analyst, V: bachelor’s + 10 years or master’s + 8 years
• Information Security Analyst, VI: bachelor’s + 12 years or master’s + 10 years
• Information Security Analyst, VII: bachelor’s + 14 years or master’s + 12 years

Technologies

• SIEM
• EDR
• SOAR

Preferences

• Strong operational security background
• Experience analyzing large volumes of logs, network data, and other attack artifacts during investigations
• Proficiency with SIEM and SOAR platforms; ability to apply behavioral, statistical, and machine learning techniques across multiple data sources
• Solid understanding of the network threat lifecycle, attack vectors, and exploitation methods (TTPs)
• Experience securing cloud environments (AWS, Azure, GCP) and using cloud-native security tools to protect data
• Proficiency in scripting and programming

Application details

Requisition Number: PRN45436B

Employment type: Full Time

Work schedule: Monday - Friday, 9 a.m. - 5 p.m. with on call responsibilities after hours, weekends, and holidays

Department: 00954 - UIT Systems & Security

Location: Campus (Salt Lake City, onsite)

Pay rate range: $100,000 to $195,795

Close date: 7/6/2026

How to apply: visit https://utah.peopleadmin.com/postings/204073