Senior Security Analyst

The Senior Security Analyst role supports the Division of the Office of the CISO, with a focus on cyber incident response and vulnerability management. The position operates within a security operations environment, handling SOC alert triage, incident assessment, vulnerability scanning triage, and coordination of remediation activities across applications, infrastructure, and cloud.

Key Responsibilities

• Perform alert triage for security alerts to validate, prioritize, and determine which incidents require follow-up.
• Assess incident severity, impact, and root cause using MSSP capabilities and internal tools.
• Monitor and respond to security alerts and events from tools including SIEM, IDS/IPS, firewalls, email, and endpoint detection and response (EDR), meeting defined SLAs.
• Conduct initial incident triage and assessment to confirm severity and impact.
• Carry out routine reviews of IAM to identify and address abuse of permissions by authorised users.
• Monitor for policy violations and report suspicious user behaviour.
• Assist with containment activities, including isolating affected systems under supervision.
• Maintain work notes and artifact logging in ITSM systems (ServiceNow / Confluence) for incident tickets.
• Complete shift handovers to other SOC team members to support continuity of ongoing incidents, including providing clear updates and escalation details.
• Seek guidance from, and escalate as needed to, Mid-level Tier 2 analysts.
• Support daily security operations by running regular vulnerability scans, analyzing reports, and triaging identified issues for timely risk mitigation.
• Lead end-to-end vulnerability remediation coordination across applications, infrastructure, and cloud environments, working closely with development and operations teams to implement sustainable security controls.
• Optimize vulnerability scanning profiles, dashboards, and reports to improve coverage, actionable insights, and remediation guidance.
• Contribute to continuous improvement of vulnerability management processes, policies, and procedures, including support for incident response activities and alignment with industry best practices.
• Stay current on evolving cyber security threats, vulnerabilities, and attack techniques.
• Participate in on-call rotations and provide triage and escalation support.
• Handle security inbox queries and ensure timely responses to security-related inquiries.
• Perform other duties as assigned.

Requirements

• 2+ years in an Information Security role with proven experience in Security Operations or Threat Analysis.
• Hands-on experience with SIEM and EDR platforms.
• Analytical mindset with knowledge of TTPs, malware behaviour, and incident handling methodologies.
• Familiarity with IAM concepts and monitoring, including reviewing permissions, detecting abuse, and flagging suspicious behaviour or policy violations.
• Experience performing alert triage and incident escalation within defined SLAs, using ITSM tooling such as ServiceNow and documentation platforms such as Confluence.
• Strong collaboration skills working with application and infrastructure teams in a security context.
• In-depth knowledge of security best practices and frameworks (for example MITRE ATT&CK, OWASP Top 10, NIST).
• Excellent written and verbal communication skills, including the ability to produce work notes, handover reports, and stakeholder updates.
• Ability to manage multiple projects and tasks.
• Ability to capture and summarise information, solve tactical and strategic problems, and prioritize work.
• Exposure to public cloud infrastructure (SaaS, IaaS, and PaaS).

Technologies

SIEM, IDS/IPS, firewalls, email, endpoint detection and response (EDR) systems, MSSP, ITSM (ServiceNow / Confluence), ServiceNow, Confluence, MITRE ATT&CK, OWASP Top 10, NIST, EDR, IAM, Python, PowerShell, KQL, SOAR, OpenCTI, Recorded Future, MISP, CompTIA Security+, CySA+, CEH, SANS, Cloud Certifications.

Nice to Have

• 1+ years of experience within Incident Response and/or Security Operations.
• Scripting or automation experience (Python, PowerShell, KQL) to enhance SOC playbooks, enrich alerts, or reduce manual triage effort.
• Exposure to SOAR platforms and use-case development for automating repeatable response actions.
• Experience working alongside an MSSP or within a co-managed SOC model.
• Familiarity with threat intelligence platforms (OpenCTI, Recorded Future, MISP) and applying CTI to detection and hunting.
• Relevant Information Security certifications (for example CompTIA Security+, CySA+, CEH, SANS, Cloud Certifications).

Location and Work Model

Denver, CO (hybrid). Hybrid working and reasonable accommodations are supported.

Compensation and Posting Details

• Base salary range: USD 110,000 - 120,000 per year. Range is estimated for the role and actual pay may vary.
• This position will be open through November 15, 2026.
• Colorado law requires an estimated closing date for job postings; applicants should not be discouraged if the date shown has passed.
• Internal posting duration: minimum of five calendar days.

Internal Applicant Notes

• Internal applicants must inform their current supervisor/manager prior to applying.
• Internal applicants must be in “good standing,” defined as a performance rating of “met all objectives” or higher.
• Internal applicants cannot be on a current performance improvement plan or written warning, and must have been in the current role for a minimum of 6 months unless approved for early transfer by their current leader and the People Department.

Benefits

• Generous Holiday policies.
• Excellent Health and Wellbeing benefits, including corporate membership to Wellhub.
• Paid volunteer time.
• Professional development support, including professional development courses and tuition/qualification reimbursement.
• Maternal/paternal leave benefits and family services.
• Unique employee events and programs, including a 14er challenge.
• Complimentary beverages, snacks, and all employee Happy Hours.
• Annual Bonus Opportunity: position may be eligible for an annual discretionary bonus award from the profit pool.
• Additional total rewards package elements may include competitive compensation and pension/retirement plans, along with various health, wellbeing, and lifestyle benefits.

Additional Expectations

• Flexible working hours may require scheduled work on weekends and/or holidays, including being on-call.
• On-call rotations include triage and escalation support.
• Perform other duties as assigned.