Security Analyst III
Location: Houston, Texas
Job Type: 12+ month contract
Job Mode: 3 days onsite/2 days remote
Overview
The Security Analyst III serves as a senior, hands-on technical resource within Security Operations, responsible for advanced threat investigation, digital forensics, malware analysis, and end-to-end incident response. This individual will take ownership of complex and high-severity security incidents, driving investigations from initial detection through containment, eradication, recovery, and root-cause analysis.
This role requires deep technical expertise in digital forensics and incident response (DFIR), including malware analysis/reverse engineering, evidence preservation, and maintaining chain of custody during investigations. The Security Analyst III also serves as an escalation point and mentor within the SOC and supports a 24/7/365 global environment through an on-call rotation.
Key Responsibilities
- Lead hands-on investigation and response for complex and high-severity cybersecurity incidents.
- Perform digital forensic analysis of compromised endpoints, systems, files, and other artifacts to determine attack vectors, scope, root cause, and impact.
- Perform malware analysis and reverse engineering to understand malicious behavior, indicators of compromise (IOCs), persistence techniques, and potential impact.
- Collect, preserve, document, and handle forensic evidence while maintaining chain of custody throughout investigations.
- Drive incidents through containment, eradication, recovery, and root-cause analysis, taking direct technical action when necessary rather than simply escalating incidents.
- Support and/or run major incident response, coordinating technical investigation and remediation activities across security and infrastructure teams.
- Perform advanced threat hunting and investigation using SIEM, EDR/XDR, threat intelligence, network data, and other security telemetry.
- Tune and optimize SIEM detections, alerts, dashboards, and security tooling to improve detection accuracy and response capabilities.
- Present findings from threat analysis, forensic investigations, and major incidents to technical and non-technical stakeholders.
- Create and maintain incident response procedures, investigation documentation, playbooks, data flows, and technical diagrams.
- Support cybersecurity system upgrades, new SOC technologies, Disaster Recovery planning, and change management.
- Act as a senior escalation point and mentor to junior SOC/security analysts.
- Drive continuous improvement across security tools, incident response processes, and detection capabilities.
Required Skills & Experience
- 8+ years of cybersecurity experience, with significant hands-on experience in Security Operations, Incident Response, or DFIR.
- Demonstrated experience owning major cybersecurity incidents from detection/investigation through containment, eradication, recovery, and root-cause analysis.
- Hands-on digital forensics experience, including acquisition and analysis of system/endpoint artifacts and preservation of forensic evidence.
- Hands-on malware analysis experience, including the ability to analyze and reverse engineer malicious files/code to determine behavior and indicators of compromise.
- Strong understanding of forensic evidence handling and chain-of-custody requirements.
- Experience investigating compromised Windows environments, endpoints, networks, and enterprise systems.
- Advanced threat detection, threat hunting, forensic investigation, and threat intelligence capabilities.
- Hands-on experience with SIEM and security monitoring platforms such as Splunk and Microsoft Sentinel, as well as EDR/XDR technologies.
- Ability to independently investigate complex incidents, determine appropriate containment actions, and drive incidents toward resolution.
- Experience serving as a senior SOC escalation point and mentoring less-experienced analysts.
- Strong written and verbal communication skills, including presenting complex incident findings to technical teams and leadership.
