Staff Incident Responder

Welcome to Warner Bros. Discovery... the stuff dreams are made of.

Who We Are...

When we say, "the stuff dreams are made of," we're not just referring to the world of wizards, dragons and superheroes, or even to the wonders of Planet Earth. Behind WBD's vast portfolio of iconic content and beloved brands, are the storytellers bringing our characters to life, the creators bringing them to your living rooms and the dreamers creating what's next...

From brilliant creatives, to technology trailblazers, across the globe, WBD offers career defining opportunities, thoughtfully curated benefits, and the tools to explore and grow into your best selves. Here you are supported, here you are celebrated, here you can thrive.

Your New Role

The Staff Incident Responder (Cyber Security Operations Center Analyst) will be responsible for guiding a hybrid team of security analysts tasked to detect, analyze, respond, report, and triage cybersecurity incidents. The successful candidate will also be focused on developing new detection rules/use cases within our SIEM and security tool stack. This individual must be highly organized and able to manage multiple projects and deliverables at once.

• Advise, implement, and continuously improve security detections and alerting mechanisms to enhance threat visibility and reduce risk.

• Collaborate on, maintain, and enforce technical and administrative security processes and procedures to support consistent and effective security operations.

• Document, publish, and communicate investigative findings across the organization to drive continuous improvement and institutional awareness.

• Support the refinement, development, and optimization of SOAR automations to improve response efficiency and reduce manual intervention.

• Advise ongoing alert logic refinement through systematic tuning, validation, and allowlisting to improve alert fidelity and reduce false positives.

• Incident support through delivery of Work Streams items and contributions to incident reports.

• Serve as the technical escalation point for the Tier 1 and Tier 2 CSOC resources.

• Provide ad-hoc training to team members.

• Contribute to CSOC maturity projects under the guidance of Cyber Operations Leadership

• Partner with Security Engineering teams to enhance features and capabilities within current security tooling.

• Create and update written policies and procedures to align with new technologies or improved detection fidelity.

• 5+ years of relevant experience or equivalent combination of education and work experience

• Ability to think critically to solve problems.

• Ability to perform root cause analysis of problems or security events.

• Familiarity with Linux, MAC and Windows Operating Systems.

• Experience performing log analysis from a variety of host-based and network-based sources.

• Familiarity with EDR solutions

• Familiarity with SIEM platforms

• Familiarity with forensic evidence concepts

• Knowledge of exploits, vulnerabilities, malware families and common attack vectors

• Scripting (Python, PowerShell, bash), regex experience is preferred.

• Experience with firewalls, intrusion detection/prevention systems

• Effective in collaborating with teams in remote offices.

• Exceptional verbal and written communication skills, specifically the ability to communicate within the context of the intended audience, whether that be senior executives or highly technical engineering resources.

• Intermediate or higher Security Certifications are a plus - CYSA+, CISSP, CFR, CHFI, GCIH, GCFA, or GNFA, PenTest+, OSCP, etc.