Senior Security Analyst

Netradyne harnesses the power of Computer Vision and Edge Computing to revolutionize the modern-day transportation ecosystem. We are a leader in fleet safety solutions. With growth exceeding 4x year over year, our solution is quickly being recognized as a significant disruptive technology. Our team is growing, and we need forward-thinking, uncompromising, competitive team members to continue to facilitate our growth. About Netradyne and the Global SOC Netradyne builds AI-powered video telematics and fleet safety solutions, led by its Driver-i platform, used by commercial fleets worldwide. Our environment spans cloud-native SaaS, edge IoT devices in vehicles, large volumes of video and telemetry data, and AI/ML platforms. The Global SOC protects this footprint around the clock. It runs a multi-cloud SOC integrating SIEM, SOAR, threat intelligence, endpoint, identity, email, SaaS and cloud telemetry, and is moving to an AI-driven operating model with agentic triage, correlation and response under human approval controls. The SOC also supports ISO 27001 and ISO/IEC 42001 governance and the AI Security Posture Management (AISPM) program. Role purpose You will lead investigations that L1 cannot close, drive incidents to containment, and continuously raise the quality of our detections. You will be a hands-on technical leader on shift: mentoring L1 analysts, tuning the AI-assisted triage pipeline, and turning every incident into better playbooks, detections and controls across AWS, Azure, SaaS, endpoints and our IoT fleet platform. Key responsibilities Monitoring, triage and investigation Act as the L2/L3 escalation point for alerts across SIEM, EDR, identity, email, SaaS and cloud security tools. Perform deep-dive investigations correlating logs, endpoint telemetry, network data, cloud audit trails and threat intelligence. Validate, enrich and prioritize alerts using a risk-based approach, and reduce false positives at source. Review and quality-check L1 triage decisions and AI-generated triage recommendations before closure. Incident response Lead security incidents through detection, containment, eradication, recovery and post-incident review. Coordinate with Engineering, SRE, IT, Legal and Privacy during incidents, and communicate status clearly to SOC leadership. Perform host and cloud forensics triage, malware analysis at a functional level, and evidence preservation. Write incident reports and root-cause analyses with concrete, tracked remediation actions. Detection engineering and threat hunting Build, test and tune detection rules and correlation logic, mapped to MITRE ATT&CK. Run hypothesis-driven threat hunts across cloud, endpoint, identity and SaaS telemetry. Track coverage gaps and propose new log sources, detections and use cases. Operationalize threat intelligence (IOCs, TTPs, advisories) relevant to SaaS, cloud and IoT environments. Automation and AI-driven SOC Design and improve SOAR playbooks for enrichment, triage and response. Help define and validate AI agent workflows, confidence thresholds, guardrails and human-approval gates for security operations. Monitor AI security signals from the AISPM program, including shadow AI, unauthorized agents, unregistered MCP services and data-leakage alerts. Process, metrics and mentoring Maintain runbooks, playbooks, escalation matrices and SOPs. Track and improve SOC metrics such as MTTD, MTTR, SLA adherence and false-positive rate. Mentor and coach L1 analysts, run shift handovers and knowledge-sharing sessions. Provide evidence and support for ISO 27001, ISO/IEC 42001 and customer security audits. Required qualifications Bachelor's degree in Computer Science, IT, Cybersecurity or equivalent practical experience. 5–8 years in information security, with 3+ years in a SOC at L2 or L3. Hands-on expertise with at least one enterprise SIEM (Splunk, Wazuh, QRadar or similar), including writing queries and detection rules. Strong experience with EDR/XDR platforms such as CrowdStrike Falcon or Microsoft Defender. Solid understanding of AWS and Azure security logging and services (CloudTrail, GuardDuty, Security Hub, Entra ID, Defender for Cloud). Working knowledge of identity attacks and controls: SSO, federation, MFA, conditional access, privileged access. Proven incident handling experience, including ransomware, phishing/BEC, account compromise and cloud misconfiguration incidents. Good grasp of networking (TCP/IP, DNS, HTTP/S, VPN, firewalls, proxies) and Windows, Linux and macOS internals. Practical use of MITRE ATT&CK, the cyber kill chain and incident response frameworks such as NIST SP 800-61. Scripting ability in Python, PowerShell or Bash for automation and log analysis. Clear written and verbal communication, including incident reports for technical and leadership audiences. Preferred qualifications Certifications such as GCIH, GCIA, GCFA, CySA+, BTL1/BTL2, CEH, or AWS/Azure security certifications (AWS Security – Specialty, AZ-500, SC-200). Experience building SOAR playbooks and integrating security tools through APIs. Exposure to LLM-based or agentic security workflows, AI security risks (prompt injection, data leakage, model abuse) and AI governance. Experience securing SaaS platforms, containers and Kubernetes, or IoT and edge devices. Digital forensics and malware analysis skills beyond triage level. Familiarity with ISO 27001, ISO/IEC 42001, SOC 2 or NIST CSF audit evidence. Experience in a product or SaaS company with a global, 24x7 customer base. Technology environment SIEM and log analytics - Wazuh, Splunk, ELK Endpoint and XDR - CrowdStrike, Microsoft Defender Email security - Proofpoint Automation - SOAR, Python, REST APIs<span class="A