Senior CIRT Analyst

JOB DESCRIPTION

Location: New York, NY, Denver, CO, Canton, MA or Bolingbrook, IL

In this position, you'll be based in the New York, Denver, Canton or Bolingbrook office for a minimum of three days a week, with the flexibility to work from home for some of your working week. Find out more about our flexible work culture at computershare.com/flex.

We give you a world of potential

Computershare has an exciting opportunity for a permanent full-time Senior CIRT Analyst to join our Computershare Shared Services (CSS) team within our Global Information Security (GIS) department.

A role you will love

As a Senior CIRT (Cyber Incident Response Team) Analyst, you will play a critical hands-on role within the Cyber Defence team, responsible for leading complex incident investigations, building and tuning threat detection capabilities, and mentoring SOC Analysts to support global 24/7 operations. In this role, you will act as the primary escalation point for incidents that exceed Tier 1/2 capabilities and ensures operational continuity outside of Security Operations leadership working hours. This includes close collaboration with teams like Security Engineering, Threat Intelligence, the NOC and Incident Management to manage and resolve cyber security incidents to competition.

Alongside our colleagues in Security Engineering, which drives strategic control implementation, you will be focused on the operational and tactical build out of threat detection and response. You will proactively translate real-world threats and attack behaviours into effective detection logic across SIEM and EDR platforms, conduct targeted threat hunts and help embed high-confidence detection into playbooks and response workflows, supporting our Incident Detection and Response Capability.

Our Senior CIRT Analysts are regionally aligned in a follow-the-sun model including positions in the Americas, EMEA and APAC. They have a global presence, but also regional expertise, working alongside and advising our regional CISO teams on regional compliance and reporting requirements from a technical perspective.
Please note: This role requires you to work a 9:00 am - 5:00 pm Mountain Standard Time (MST) schedule as well as an on-call rotation.

Other key responsibilities include:

• Act as the senior escalation point for complex or high-severity incidents.
• Lead incident response lifecycle from detection through to post-incident review.
• Perform high level forensic analysis across cloud, endpoint and network data.
• Develop and execute hypothesis driven hunts across available telemetry.
• Use results to identify gaps or refine detection logic.
• Build, tune, and document detection logic in Sentinel, Defender, CrowdStrike and other platforms.
• Translate threat intelligence into rules and analytics to support incidents.
• Maintain and execute MITRE ATT&CK coverage plans.
• Design and improve operational playbooks and SOAR workflows.
• Implement response logic for recurring incident types.
• Support the development of SOC Analysts by providing escalation support, training and structured feedback.

• The ability and willingness to work a 9:00-5:00 Mountain Standard Time (MST) schedule
• Flexibility to work an on-call rotation which will include some weekends and public holidays (current schedule is 1 week every 6 weeks but is subject to change)
• 2+ years' experience in SOC, IR or similar roles with demonstrable in threat hunt or tier 3 response
• Experience building detection logic and analytics rules (e.g. KQL, Sigma)
• Deep understanding of MITRE ATT&CK, threat actors, and attack chains
• Strong verbal and written communication skills including report writing skills, the ability to brief groups of people and the ability to translate technical terms into easy-to-understand concepts for non-technical colleagues
• Experience in financial services, aviation, government or other regulated industries

• GIAC certifications (e.g. GCIA, GCIH, GNFA, GMON, GCFA), Microsoft SC-200, AZ-500 or equivalent
• Experience with Sentinel, Defender and CrowdStrike
• Strong scripting knowledge (PowerShell, python etc)
• Knowledge of Security Frameworks including SOC2, ISO 27001 and NIST
• Active geopolitical awareness
• Bachelor's degree or a master's degree in a relevant field