Security Operations Analyst

Seattle-based analyst on Anduril's Detection and Response team, responsible for spotting and countering hostile activity aimed at the company's defense systems. Day to day that means working alerts from email, endpoints, cloud infrastructure and SaaS apps, building detections and automated playbooks with detection-as-code practices, helping detection engineering reduce noise, hunting through organisation-wide data for unusual behaviour, and taking part in threat modelling and on-call response. Senior analysts serve as incident commanders.

Anduril wants someone who has done security monitoring and detection work in large data sets, written Python for a shared SOC automation codebase, used SPL, KQL or SQL, and understands attacker techniques across Windows, Linux, macOS, AWS and Azure. A Top Secret clearance must be obtainable.