Leadbank Senior Security Analyst at Leadbank to build detection and response capabilities and manage incident response across cloud infrastructure and security tooling. Mentor junior analysts and ensure compliance with banking security standards.
Responsibilities
Build, tune, and maintain detection rules and alerts in our SIEM, writing queries to identify threats and coverage gaps aligned to MITRE ATT&CK
Own incident response execution end-to-end — containment, eradication, recovery, and lessons learned — including forensic log analysis and post-incident reporting
Monitor and investigate security events across endpoints, cloud (AWS), identity, and network telemetry — identifying misconfigurations, anomalous activity, and suspicious behavior
Assist with security audits and regulatory examinations, ensuring timely and accurate security documentation and evidence is provided
Analyze systems, applications, and networks for security configurations in partnership with security engineers.
Manage log pipelines including ingestion, parsing, normalization, and enrichment to ensure high-fidelity data is available for detection and investigation
Triage and prioritize vulnerability findings using risk-based frameworks and track remediation SLAs with IT and Engineering
Collaborate with Engineering on IaC and CI/CD security reviews, and contribute to runbooks and playbooks
Perform all other duties as assigned
What we are looking for:
5+ years in information security or security operations
Hands-on SIEM experience with query writing, detection building, and alert tuning
Qualification
Experience with log routingRelevant certificationsExposure to identity security tooling
Preferred
Experience with log routing, transformation, and enrichment
Hands-on experience with an enterprise EDR/XDR platform and its ecosystem tooling — SOAR, exposure management, and identity protection
Experience with network security tools and interpreting proxy or web traffic logs Background in a regulated industry (financial services, healthcare) with familiarity with NIST CSF, GLBA, or FFIEC
Scripting or automation experience (Python, Bash) for detection engineering, workflow automation, and version-controlled code in GitHub
Relevant certifications: CISSP, GCIH, GCIA, GCED, CEH, GDSA, or equivalent
Detection as Code experience using version-controlled detection content
