Senior Cyber Threat Analyst

Harbor IT

Senior Cyber Threat Analyst at Harbor IT investigating complex security incidents and communicating findings with clients. Collaborating with SOC analysts and providing escalation support.

Posted 7/22/2026full-timeRemote • 🇺🇸 United StatesSenior💰 $80,000 - $85,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in cybersecurity incident response, threat detection, and analysis, with a strong focus on network traffic analysis and security log interpretation. Proficient in mentoring junior analysts and communicating complex security concepts effectively to clients.

Highest-signal resume keywords

Cybersecurity ExperienceIncident Response LifecycleNetwork Traffic AnalysisSIEM PlatformsMentoring Analysts

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseThreat DetectionSecurity Log AnalysisNetwork Traffic AnalysisTCP/IPDNSHTTP/SActive DirectoryCloud SecurityPacket-Level Investigation

Soft Skills

Excellent Communication SkillsMentoringDecision-Making Under Pressure

Tools & Technologies

SIEMEDR ToolsIDS/IPS TechnologiesPacket Analysis ToolsVulnerability InformationCase Management Workflows

Industry Keywords

CyberattacksIndicators of CompromiseContainmentEradicationRemediationDetection EngineeringThreat Landscape

Tech Stack

Tools & technologies

CloudCyber SecurityDNSLinuxTCP/IP

About the role

Key responsibilities & impact

Monitor, triage, investigate, and resolve security events and incidents within established client service-level agreements.
Perform advanced analysis across SIEM, EDR, IDS/IPS, firewall, DNS, identity, cloud, operating system, application, and database telemetry.
Lead or support incidents through the full incident response lifecycle, including preparation, identification, analysis, containment, eradication, recovery, and post-incident improvement.
Correlate network, endpoint, identity, and log evidence to determine attack scope, impact, root cause, and recommended remediation.
Recognize common attack techniques and provide practical containment and remediation guidance appropriate to the affected environment.
Serve as the first escalation point for junior analysts, providing a second review of investigations, validating conclusions, and coaching analysts through complex decisions.
Advise on alert tuning, detection quality, false-positive reduction, rule logic, thresholds, suppression criteria, and documentation improvements with the Detection Engineering Team.
Communicate directly and professionally with clients by telephone, email, and meetings, clearly explaining security findings, risk, business impact, response options, and next steps.
Escalate high-severity or high-impact incidents according to process and exercise sound judgment when available data is incomplete.
Create and improve investigation notes, client-facing incident communications, detection logic, procedures, and knowledge-base content.
Remain current on threat actor behavior, vulnerabilities, exploits, defensive techniques, and relevant changes in the threat landscape.
Participate in a rotating on-call schedule of two weeks on call followed by four weeks off. Employees receive an additional 10% compensation during scheduled on-call periods.
Serve as a voice of authority during the SOC Manager’s absence.

Requirements

What you’ll need

3+ years of relevant cybersecurity experience, including hands-on experience in a SOC, incident response, threat detection, managed security, or closely related operational role.
Deep familiarity with networking fundamentals and traffic analysis, including TCP/IP, DNS, HTTP/S, routing, subnetting, public and private addressing, NAT/SNAT/DNAT, common ports and protocols, and packet-level investigation.
Deep familiarity with common cyberattacks, attacker techniques, indicators of compromise, likely impact, and effective containment, eradication, recovery, and remediation steps.
Deep familiarity with incident response lifecycles and the ability to apply them consistently during real-world investigations.
Advanced experience analyzing security logs and network traffic from diverse sources and distinguishing malicious activity from benign anomalies.
Strong working knowledge of Windows, Linux, Active Directory, authentication activity, endpoint telemetry, and cloud security concepts.
Experience with SIEM platforms, IDS/IPS technologies, EDR tools, packet analysis tools, vulnerability information, and case management workflows.
Ability to interpret and preferably develop or tune detection content, such as Snort, Suricata, YARA, SIEM queries, vendor rules, or alert logic.
Excellent written and verbal communication skills, including the ability to speak confidently and eloquently with clients about technical security topics, risk, and remediation.
Demonstrated ability to mentor analysts, provide constructive review, and make defensible decisions under time pressure with minimal supervision.
Ability to work Monday – Friday 9 am – 6 pm ET and participate in the rotating on-call schedule.
U.S. Work Authorization (Harbor IT is unable to provide visa sponsorship for this role).

Benefits

Comp & perks

100% employer-paid employee benefits, with additional premium selections available
401(k) matching
Reimbursement for approved tuition, certifications, conference attendance, and related professional development
Harbor IT-approved holidays, when applicable
A culture that supports employees in putting family first
Additional benefits based on position and eligibility