Security Operations Analyst

Analyst on Anduril's Detection and Response team in Boston who monitors for and responds to adversaries targeting the company's defense technology. The work covers triaging phishing, endpoint, cloud and SaaS alerts, building detections, response playbooks and automation under detection-as-code, closing the loop with detection engineering to cut false positives, hunting for anomalies in organisation-wide data, contributing to threat models, and on-call incident response. At the senior level the analyst also commands incidents and coaches junior colleagues.

Candidates need hands-on monitoring and detection work over large, varied log sources, Python contributions to SOC automation, SPL, KQL or SQL, analysis in a data lake, and broad knowledge of attacker TTPs on Windows, Linux, macOS and cloud. Eligibility for a Top Secret clearance is required.