Security Analyst - Tier 3 (West Coast)

About the role

As a Tier 3 Security Analyst at sevenai, you will lead technical validation of AI‑driven investigations, mentor junior analysts, and help shape the next generation of security operations.

Key responsibilities

• Review and validate the AI agents' investigations for accuracy and completeness, assessing risk.
• Serve as the technical escalation point for junior analysts and mentor them.
• Correlate data across cloud, endpoint, identity, and network sources to build the full picture of an attack.
• Investigate malicious activity the AI agents responded to, and assess the risk that was prevented for customers.
• Use sevenai's AI agents to hunt for emerging threats in customer environments, feeding new detections back into the product.
• Support customers with ongoing threat monitoring, triage, and alert prioritization, especially during active incidents.
• Proactively review logs and findings to catch potential threats and anomalies early.
• Communicate clearly with customers across technical levels, from SOC analysts to CISOs.
• Help design processes that let the team scale while keeping quality consistent.
• Work with Sales, Engineering, and Product to share customer feedback and help tune the platform.

Required profile

• 5+ years of experience in security operations.
• Hands‑on experience investigating alerts across endpoint, network, identity, email, and cloud sources.
• Strong understanding of security monitoring tools such as XDR, SIEM, IDS/IPS, and IDP.
• Familiarity with log and telemetry concepts.
• Strong knowledge of common attack techniques and frameworks such as MITRE ATT&CK.
• Strong analytical and problem‑solving skills, with ability to verify AI‑driven analysis.
• Data querying experience with SIEM query languages (SPL, KQL, FQL, SQL).
• Strong knowledge of malware analysis methods.
• Strong interpersonal skills and a service‑oriented mindset.
• Track record of mentoring and teaching complex concepts.

Required skills

• XDR
• SIEM
• IDS/IPS
• IDP
• MITRE ATT&CK
• SPL
• KQL
• FQL
• SQL
• malware analysis