Senior Analyst, Information Security

Norton Rose Fulbright

Senior Information Security Analyst leading SOC monitoring, incident response, threat hunting and detection engineering. Supporting Norton Rose Fulbright’s global legal services business.

Posted 8/25/2026full-timeHouston • Texas • 🇺🇸 United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Security Operations, Incident Response, and Threat Detection, with a strong focus on Microsoft 365 Defender, Microsoft Sentinel, and structured methodologies like NIST. Proficient in developing and maintaining detection rules, automating security processes, and mentoring junior analysts.

Highest-signal resume keywords

Microsoft 365 Defender ExpertiseIncident Response ManagementThreat Hunting and Detection EngineeringSecurity Automation with PowerShell/PythonCloud Security Knowledge (Azure, AWS, GCP)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseThreat DetectionSecurity MonitoringDetection EngineeringPhishing RemediationEDR and SIEM KnowledgeCloud Security SolutionsSecurity AutomationDigital ForensicsVishing and Impersonation Attack Response

Soft Skills

Technical LeadershipMentoringCollaborationAdaptabilityCommunication

Tools & Technologies

Microsoft SentinelServiceNowZscalerMimecastProofpointCiscoSOAR ToolsEDR SolutionsDLP SolutionsMonitoring Systems

Certifications & Qualifications

Microsoft SC-200GIAC GSOCGIAC GCIHCompTIA Security+CISSP

Industry Keywords

SOC OperationsMITRE ATT&CKNIST MethodologiesIdentity and Access ManagementCloud Logging and Telemetry

Tech Stack

Tools & technologies

AWSAzureCloudFirewallsGoogle Cloud PlatformLinuxPythonServiceNow

About the role

Key responsibilities & impact

Provide technical leadership in the SOC’s day-to-day monitoring, detection and response activities
Hunt for emerging adversary activity and continuously improve threat detection and response capabilities
Perform security monitoring, event and incident triage, incident response, request management, detection engineering and proactive threat hunting
Manage security incidents and requests according to SLA guidelines as an intermediate escalation point for complex investigations
Monitor, triage and investigate alerts across endpoint, cloud, identity, email and network telemetry
Lead structured incident response, including containment, eradication, recovery, evidence preservation and authorized digital forensic analysis
Triage and remediate phishing, vishing and impersonation attacks
Configure and tune security parameters in monitoring systems and escalate alerted issues technically
Conduct scheduled, hypothesis-driven threat hunting
Design, test, tune and maintain detection rules and use cases such as Sigma / KQL
Map detection coverage to MITRE ATT&CK and close detection gaps
Translate adversary tradecraft, emerging attack techniques and threat intelligence into improved detections
Develop and maintain SOAR playbooks and automate repetitive operational tasks
Use and quality-assure AI-assisted detection, triage and investigation tooling
Mentor junior and peer analysts and support regional skills development and succession planning
Own and improve one or more SOC processes, functions or technologies globally
Maintain SOC playbooks, runbooks, monitoring configurations and standard operating procedures
Report on incidents and collaborate with regional IT teams to prevent recurrence

Requirements

What you’ll need

Technical bachelor’s degree or equivalent IT / Information Security experience (required)
At least 5 years’ experience working within security operations or Information Security infrastructure, or strong vocational and demonstrable transferable experience from another technical discipline
Proven ability to adapt quickly to emerging threats or new information
Expertise in Microsoft 365 Defender and Microsoft Sentinel
Strong knowledge of firewalls, IDS/IPS, EDR, SIEM and structured incident-response methodologies such as NIST
Working knowledge of endpoint security and monitoring infrastructure, including EDR, DLP and removable-media encryption
Working knowledge of cloud-based web and email security solutions such as Zscaler, Mimecast, Proofpoint and Cisco
Ability to triage and remediate phishing and impersonation attacks
Experience with a service management tool such as ServiceNow
Demonstrable, in-depth expertise in at least one domain: Identity & Access; Cloud Security; Windows & Linux Operating Systems; or Security Automation & Detection Engineering
Identity & Access expertise may include Active Directory, Entra ID / Azure AD, conditional access, privileged access, authentication protocols and ITDR
Cloud Security expertise may include Azure, AWS or GCP, cloud logging and telemetry, posture signals, and cloud-native detection and response
Windows & Linux expertise may include event log and audit analysis, process and memory investigation, and OS hardening
Security Automation & Detection Engineering expertise may include PowerShell and/or Python, SOAR playbook development, Sigma / KQL detection engineering
Preferred certifications include Microsoft SC-200, GIAC GSOC, GIAC GCIH, BTL1, AZ-500, SC-300, GCFA, GCFE, GIAC GPYC, CompTIA Security+, GIAC GSEC, CISSP or CCSP

Benefits

Comp & perks

Three medical insurance plans
Dental insurance
Vision insurance
Life insurance
Disability insurance
Health savings accounts
Flexible spending accounts
401(k) savings plan, if eligible
Profit-sharing plans, if eligible
Fertility benefits for full-time employees
Commuter benefits where applicable
Student loan assistance refinancing options
Minimum 20 days of paid time off based on role and tenure
Minimum 14 weeks of paid maternity and paternity leave
Back-up child care support program
11 Firm holidays