MDR Analyst

This role is only open to USA Citizens working on the West Coast of America

USA Westcoast | Remote | $105k to $120k per annum | Permanent

The role is a Senior MDR Analyst position within a newly developing US Security Operations Centre capability. It is a fully remote, permanent US-based role operating during West Coast business hours, intended for a highly experienced analyst who can work independently and take ownership of complex security incidents from day one.
The successful candidate will independently investigate, contain, and document complex cyber security incidents. Act as a trusted technical escalation point for US customers. Improve threat detection, response processes, and operational playbooks. Help establish standards and practices for the growing US MDR service.

Core Responsibilities

• End-to-end ownership of incident response, including triage, investigation, containment, remediation, customer communication, and post-incident reviews.
• Advanced analysis of:
  • EDR/XDR and SIEM alerts
  • Windows, Sysmon, identity, email, cloud, and network telemetry
  • PowerShell, persistence mechanisms, credential theft, lateral movement, command-and-control activity, and data exfiltration.
• Threat hunting and detection engineering aligned to MITRE ATT&CK.
• Writing and tuning detection logic and security monitoring content.
• Leading customer-facing discussions and producing executive and technical reports.
• Supporting onboarding activities and validating monitoring coverage.
• Mentoring junior analysts and improving SOC processes.

Technical Requirements

Candidates must demonstrate:

• Significant MDR, MSSP, or mature SOC experience with independent ownership of complex incidents.
• Strong EDR/XDR expertise (e.g. CrowdStrike, Microsoft Defender, SentinelOne).
• Advanced SIEM investigation skills (e.g. Microsoft Sentinel, QRadar, Splunk, Chronicle).
• Windows investigation expertise, including Sysmon and PowerShell analysis.
• Network investigation capability using DNS, firewalls, IDS/IPS, packet captures, Wireshark, Zeek, Snort, or similar tools.
• Email security investigation experience.
• Threat hunting and detection engineering expertise.
• Malware triage and sandbox analysis.
• Automation or scripting experience using Python, PowerShell, or SOAR platforms.
• Excellent customer communication and technical writing skills.

Preferred Background

• Helped launch or scale an MDR/SOC service.
• Worked as a senior technical SME in a distributed team.
• Experience investigating Azure/Entra ID and AWS or Google Cloud environments.
• Exposure to Chronicle SOAR or similar orchestration platforms.
• Certifications such as SC-200, BTL1/BTL2, CySA+, GCIH, GCIA, OSCP, or CISSP.

Ideal Candidate Profile

In practical terms, this role is targeting a senior MDR/SOC professional who can independently lead investigations, communicate directly with customers, conduct threat hunting, build detections, automate workflows, and help shape a new US MDR operation, rather than a traditional analyst focused primarily on monitoring alerts and escalating incidents.