IT Security Analyst IV - Remote

📋 Description

• • As an IT Security Analyst IV - Remote at CSAA Insurance Group, you will play a critical role in protecting the organization’s digital assets and member data by leading advanced threat detection, incident response, and security operations initiatives. Your expertise will directly contribute to safeguarding AAA members against evolving cyber threats in an increasingly complex digital landscape.
• • You will serve as a senior technical leader within the Security Operations Center (SOC), driving high-fidelity detection engineering, leading purple team exercises, mentoring junior analysts, and improving overall security posture through proactive threat hunting and process optimization across cloud and on-prem environments.
• • The CSAA Security Operations Team is a collaborative, mission-driven unit focused on intelligence-led cyber defense, where analysts work collectively to understand adversary behaviors, validate detections, and respond to threats with precision and urgency. The team values innovation, continuous learning, and cross-functional partnership to stay ahead of emerging risks.
• • CSAA Insurance Group is a leading personal lines property and casualty insurer and a trusted AAA affiliate, committed to building human-centered solutions that help members prevent, prepare for, and recover from life’s uncertainties. The company fosters an inclusive, innovative culture where employees are empowered to grow, lead, and make meaningful impact.
• • In this role, you will deepen your expertise in adversary-focused detection engineering, incident response leadership, and purple team collaboration while gaining influence over enterprise-wide security strategy. You will have the opportunity to mentor others, lead cross-functional initiatives, and shape the future of CSAA’s SOC capabilities in a remote-first, flexible work environment.
• • Participate in and lead incident response, triage, and investigations by performing systematic analysis of security events and indicators of compromise to identify malicious activity, potential threats, and vulnerabilities.
• • Conduct post-incident analysis to identify root causes and recommend preventative measures to strengthen defenses and reduce recurrence of similar incidents.
• • Create detailed incident reports and documentation for technical and executive stakeholders, ensuring clarity, accuracy, and actionable insights for decision-making.
• • Design, develop, and maintain high-fidelity security detections aligned to adversary behaviors (e.g., MITRE ATT&CK framework), perform ongoing detection gap analysis, and recommend new detections based on emerging threats and attack techniques.
• • Tune and optimize security detections and alerts to improve signal quality, reduce false positives, and ensure actionable outcomes for the SOC, enhancing analyst efficiency and response speed.
• • Document detection logic, data dependencies, assumptions, and response guidance to support long-term maintainability, knowledge transfer, and consistent SOC effectiveness.
• • Provide technical guidance and mentorship to junior SOC analysts during investigations and detection development efforts, fostering skill growth and team resilience.
• • Lead purple team efforts to test adversary techniques, validate existing detections, identify coverage gaps, and inform the development of new or improved security alerts through collaborative red/blue exercises.
• • Proactively conduct threat hunting to identify hidden malicious activity and assess the effectiveness of existing security controls across endpoints, networks, and cloud environments.
• • Leverage threat intelligence from internal and external sources to inform detection development, threat hunting prioritization, and incident response playbooks.
• • Lead SOC project efforts and coordinate with other cybersecurity groups (e.g., GRC, vulnerability management) to elevate the organization’s overall security posture and alignment with business objectives.
• • Identify opportunities to improve security processes, technologies, and workflows, advocating for investments or changes that enhance efficiency and effectiveness.
• • Participate in on-call rotation to respond to critical security events outside regular business hours, ensuring timely containment and mitigation of high-severity incidents.
• • Participate in knowledge sharing and training initiatives, including lunch-and-learns, workshops, and documentation contributions to promote organizational security awareness.
• • Demonstrate ability to multitask and prioritize competing demands in a fast-paced, high-stakes environment while maintaining attention to detail and composure under pressure.