Security Operations Analyst II

Your Role and Impact:

Our IT Team is looking for a Security Operations Analyst II based in San Mateo responsible for leading in-depth investigations and incident response to escalated events and be involved in security-based projects as well as manage security solutions/systems. This role correlates data across SIEM/XDR, identity, endpoint, network, and SaaS/cloud sources; determines true blast radius; separates routine administrative activity from attacker behavior; and coordinates containment and remediation with Infrastructure/IT.

• Security Operations: Lead investigations for escalated incidents such as account compromises, endpoint malware, suspicious network activity, and SaaS misuse. Correlate data across SIEM/XDR, identity/SSO, endpoint/EDR, network, and cloud/SaaS logs to build attack timelines, identify entry vectors, and assess lateral movement. Coordinate containment and remediation with Infrastructure/IT—disabling or recovering compromised accounts, isolating infected endpoints and removing malware, validating EDR coverage and system integrity, and confirming cleanup success. Produce clear, audit-ready incident documentation detailing scope, evidence, actions, timelines, decisions, and resolution rationale. Act as an escalation point for the Service Desk and junior analysts, provide real-time guidance, and apply chain-of-custody and evidence-preservation practices for high-severity events, maintaining case files with hashes, screenshots, and IOC/IOA sets.
• Detection, Playbooks, Threat Intelligence, and Continuous Improvement Response: Tune and improve detections, automate repetitive workflows, and drive incident response improvements. Refine existing rules and propose new use cases based on investigations and recurring patterns; enrich cases with threat intelligence (IOCs and TTPs) and incorporate those learnings into future detections and playbooks; Contribute and evolve response playbooks for major incident types (account compromise, endpoint malware, SaaS abuse, suspicious network activity), participate in post-incident reviews with root-cause analyses and practitioner-level technical narratives, and recommend prioritized, practical prevention and mitigation improvements. Conduct targeted threat hunts (e.g., OAuth abuse, living-off-the-land binaries, credential-stuffing against legacy protocols), define and track alert-quality KPIs (true/false positive ratios, suppression coverage), and collaborate to improve MTTD/MTTR.

Here’s More of the Nitty-Gritty:

• Bachelor’s Degree in the field of Computer Science, technology, or a related area with a master’s degree preferred.
• 2–5 years in Security Operations or Infrastructure/IT Operations with a security focus.
• 2+ years Windows/sysadmin experience; macOS/Linux a plus.
• 2+ years core networking (IP, DNS, ports, VPN, firewalls).
• Hands-on experience with SIEM/XDR, EDR, identity/SSO, and cloud/SaaS logs.
• Able to read Windows event logs, perform basic endpoint triage, and apply MITRE ATT&CK for triage.
• Strong written/verbal communication and incident leadership skills.
• CompTIA Security+ required and other security certifications preferred.

Compensation and Benefits:

We offer a variety of benefits that take compensation well beyond a paycheck. This includes traditional benefits and benefits you might not expect or know about. The salary range provided is based on a number of factors, including location, job-related skills, experience, and qualifications.

• Discretionary Annual Bonus Plan
• Medical; Vision; Dental: 100% Company-paid plans (including eligible dependents) and affordable buy-up options
• Life Insurance; Accidental Death & Dismemberment Insurance; Long Term Disability
• Behavioral Health Program Accessible 24/7
• Tax-Free Flexible Spending Accounts
• 401(K) Retirement Plan with Employer Matching
• Recognition & Rewards Program (Torch)
• Vacation: 10 days per year with accrual increase overtime
• Anniversary Vacation: 40-hour Vacation Granted at Tenured Milestones
• Sick Leave: 9 days per year
• 12 paid holidays, including your birthday!
• Paid Volunteer Time
• Tenure-based Housing discounts
• Educational Assistance, Tuition Reimbursement
• Referral Bonus
• Hybrid Work Schedule