Security Analyst (Cyber Defense Analyst)

AHEAD builds platforms for digital business. By weaving together advances in cloud infrastructure, automation and analytics, and software delivery, we help enterprises deliver on the promise of digital transformation.

At AHEAD, we prioritize creating a culture of belonging, where all perspectives and voices are represented, valued, respected, and heard. We create spaces to empower everyone to speak up, make change, and drive the culture at AHEAD.

We are an equal opportunity employer, and do not discriminate based on an individual's race, national origin, color, gender, gender identity, gender expression, sexual orientation, religion, age, disability, marital status, or any other protected characteristic under applicable law, whether actual or perceived.

We embrace all candidates that will contribute to the diversification and enrichment of ideas and perspectives at AHEAD.

AHEAD is seeking an experienced Cyber Defense Analyst to join the AHEAD Corporate Security Cyber Defense team.  This position contributes to the successful delivery of AHEAD’s information security program in order to assure AHEAD stakeholders of strong operating controls and effective defensive capabilities.

The Cyber Defense Analyst is responsible for monitoring, triaging, investigating, and reporting on security events across the enterprise, with a strong emphasis on CrowdStrike Falcon, CrowdStrike NG-SIEM, detection engineering, and response automation.  A typical day will include owning escalated investigations, correlating endpoint, identity, email, cloud, and application telemetry, creating or tuning detections, developing scripts and workflows, supporting incident response, and improving the team's operational capabilities.  This is a hands-on position for an analyst who can independently investigate complex security events, develop and improve detections, and build automation that makes security operations faster, more consistent, and more effective.

Reporting directly to Corporate Security leadership, the ideal candidate is a professional, collaborative team player who can communicate clearly during high-impact investigations, and partner effectively with technical teams and business stakeholders. The analyst is also expected to share knowledge, improve repeatable processes, and help raise the technical capability of the broader Cyber Defense team.

Responsibilites

• Independently monitor, triage, and investigate security alerts and escalations across endpoint, identity, email, network, cloud, and application telemetry; determine severity, scope, business impact, and required response.

• Create, tune, and maintain NG-SIEM searches, dashboards, alerts, parsers, and detections; improve alert fidelity, reduce false positives, add meaningful context, and close visibility gaps identified during investigations or threat hunts.

• Design and implement automation for alert enrichment, investigation support, ticket creation and updates, evidence collection, reporting, notification, and approved response or remediation actions using Python, PowerShell, APIs, and security-platform workflows.

• Measure and communicate automation outcomes, including reduced manual effort, faster triage or response, improved consistency, increased coverage, and operational safeguards such as logging, error handling, testing, and human approval points.

• Conduct proactive threat hunting and threat research across CrowdStrike, NG-SIEM, Microsoft 365, identity, cloud, and other enterprise data sources to identify emerging risks and adversary behavior.

• Lead or materially support incident response activities, including containment recommendations, scoping, root-cause analysis, evidence preservation, remediation tracking, lessons learned, and post-incident detection improvements.

• Support the reliability and effectiveness of core Cyber Defense technologies by identifying telemetry, parsing, integration, configuration, and data-quality issues and driving them to resolution.

• Develop and refine incident response playbooks, automation workflows, operating procedures, and quality controls; mentor or provide technical guidance to less-experienced analysts on investigations and tooling.

• Partner with infrastructure teams and system owners to validate vulnerability findings, prioritize remediation based on exploitability and business risk, and use automation or reporting improvements to track high-risk issues through closure.

Qualifications

• 5+ years of information security experience, including 3+ years in enterprise security operations, incident response, detection engineering, or cyber defense.

• Hands-on experience with enterprise EDR and SIEM platforms; CrowdStrike Falcon and CrowdStrike NG-SIEM experience strongly preferred.

• Experience creating and tuning detections, reducing false positives, and improving detection coverage.

• Experience automating security operations with Python, PowerShell, APIs, SOAR, or other workflow platforms.

• Strong investigation, incident response, documentation, and communication skills across endpoint, identity, email, network, and cloud environments.

• Familiarity with MITRE ATT&CK, NIST CSF, CIS Controls, or similar frameworks, plus vulnerability management experience with tools such as Tenable or Wiz.

Certifications

• Bachelor's Degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field

• CCSP, GCIH, CySA+, GSEC, SSCP or similar cybersecurity certification required

Why AHEAD

Through our daily work and internal groups like Moving Women AHEAD and RISE AHEAD, we value and benefit from diversity of people, ideas, experience, and everything in between.

We fuel growth by stacking our office with top-notch technologies in a multi-million-dollar lab, by encouraging cross department training and development, sponsoring certifications and credentials for continued learning.

India Employment Benefits include

Comprehensive health insurance coverage for employees, with options to extend coverage to dependents

Paid time off and company holidays, along with additional leave benefits as per policy

Flexible work arrangements, supporting work-life balance

Learning and development opportunities to support continuous growth and upskilling

Employee wellness initiatives and programs focused on physical and mental well-being

Retirement and statutory benefits in line with India regulations

Inclusive and people-first culture, with a strong focus on collaboration and ownership