Artemis - Senior Security Analyst (MDR)

Remote - Australia2w ago

Remote Senior APAC Cloud Computing Software Security Analyst AWS Azure GCP Microsoft 365 Google Workspace

Requirements

• 4+ years of hands-on security operations experience in a SOC, MSSP, or MDR environment, at a senior or Tier 3 level where the investigation ended with your decision • 4+ years of hands-on security operations experience in a SOC, MSSP, or MDR environment • Proven investigation depth across identity (Okta, Entra ID), cloud (AWS, Azure, GCP), endpoint (EDR), and SaaS (Microsoft 365, Google Workspace) • Fluency in attacker tactics, techniques, and procedures (MITRE ATT&CK) and how they present in real telemetry • Rigor about evidence: you know what separates suspicious from confirmed, and exactly what you need to see to close that gap • Hands-on experience working with AI-assisted investigation or automation, and the judgement to know where it is strong and where it needs you • Strong customer-facing instincts. You have walked the people affected by a live security situation through what is happening and what to do about it • Excellent written communication. What you write reaches the customer as you wrote it • A high personal bar for the quality of your analysis, and a preference for being measured on it • Comfortable working a defined shift as analyst coverage expands to 24x7 • Bonus • Experience in a multi-tenant MDR or MSSP practice, working across several customer environments • Experience writing or tuning detection rules (Sigma, YARA-L, SPL, KQL, or similar) • Incident command experience, including customer executive briefings • Dedicated threat hunting or DFIR background • Daily hands-on use of AI or agentic coding tools to build your own tooling

Responsibilities

• Own the investigation and the decision - Take cases from pickup to close: establish what happened, determine the impact and blast radius, set the verdict and severity, and put your reasoning on the record. You are the one who makes the call. • Own the investigation and the decision • Investigate with real depth - Reconstruct attacker activity across identity, cloud, endpoint, and SaaS telemetry: initial access, lateral movement, persistence, and exfiltration. Pair AI-assisted investigation with hands-on log analysis, and know which one to lean on for what. • Investigate with real depth • Drive response, with the customer in control - Recommend and execute containment within each customer's authorized limits, with every action impact-previewed and reversible before it runs. Where the decision belongs to the customer, bring them the recommended action, its full impact, and a clear next step. • Drive response, with the customer in control • Move at the speed the threat demands - Work by risk, acknowledge and reach a verdict inside the response targets for each severity, and keep the most consequential work moving first. • Move at the speed the threat demands • Be the security partner customers trust - You are the voice the customer hears. Your summaries, your reasoning, and your final analysis reach them in your own words. • Be the security partner customers trust • Hunt what nothing has alerted on yet - Run hypothesis-driven and AI-assisted threat hunts across customer environments, and turn what you surface into new cases and new detections. • Hunt what nothing has alerted on yet • Help design the service, not just deliver it - Founding analysts shape what Apollo becomes: the investigative standards, the response workflows, the reporting customers receive, and the console the team works in. You will be in the room where those decisions get made, and the improvements you argue for get built. • Help design the service, not just deliver it • Make the platform sharper - Your verdicts, your reasoning, and the patterns you recognize feed straight into detection engineering and product, so a problem you solve once gets engineered away rather than worked twice. • Make the platform sharper

Benefits

• Make a real world impact. Every case you work and every call you make protects a real company and the people who depend on it. You are not working theoretical security problems, you are on the front lines of active defense, with customers who rely on the quality of your judgement. • Make a real world impact. • Range you cannot get anywhere else. You work across the full set of environments we protect and the full spectrum of attacker behavior we see, so a quarter here builds experience that years inside one environment cannot. • Range you cannot get anywhere else. • Be challenged to be better than ever before. Our team includes some of the smartest and most driven people in the world. We guarantee you will learn more in 1 year here than 10 years in another place. • Be challenged to be better than ever before. • Push the boundaries of technology. The platform handles the detection, investigation, and prioritization that consume most analysts' days, so your time goes to judgement, response, and the customer. You will help define what an AI-native SOC actually looks like. • Push the boundaries of technology. • Innovative culture. We obsess about customers, move fast with high quality, and value open communication, mentorship and learning. You will have the autonomy to drive investigations, shape the platform, and own outcomes, not just follow a runbook. • Innovative culture.