Cybersecurity Analyst

The Cybersecurity Analyst supports day-to-day Security Operations and Incident Response by monitoring and investigating threats coordinating incident response conducting threat intelligence and threat hunting managing operational vulnerability workflows and maintaining accurate cases and security metrics. Security Engineering owns security-platform engineering and vulnerability-scanning platforms while technology and application owners execute remediation. 

This position is open to candidates in the Seattle WA area. You will have a hybrid remote/in-office schedule where you will work from our casual pet-friendly office at least 3 days a week. 

Responsibilities: 

Security Monitoring & Incident Response 

• Monitor and triage alerts across identity endpoint email network cloud application vulnerability and data-protection technologies. 
• Validate enrich classify and prioritize security events and investigate phishing account compromise malware ransomware unauthorized access data exposure insider threat and third-party events. 
• Execute approved containment actions within assigned permissions and coordinate infrastructure-level or production changes with Technology Operations. 
• Collect and preserve evidence identify affected users devices accounts systems repositories and data and support eradication recovery validation heightened monitoring and closure. 

Threat Intelligence & Threat Hunting 

• Collect and evaluate intelligence from commercial government industry open-source MDR vendor and internal sources. 
• Analyze threat actors campaigns tactics techniques procedures indicators exploited vulnerabilities and targeted technologies for relevance to Trupanion. 
• Create tactical and operational intelligence products and operationalize findings through investigations detections hunting queries watchlists blocking actions phishing simulation scenarios and runbook updates. 
• Conduct hypothesis-driven hunts across identity endpoint email network cloud and application telemetry using MITRE ATT&CK and document scope queries evidence findings and follow-up actions. 

Vulnerability Management Partnership 

• Validate vulnerability findings assess risk and business exposure prioritize remediation using threat intelligence and incident telemetry identify indications of exploitation and escalate urgent vulnerabilities. 
• Perform threat hunts against affected technologies and recommend temporary containment or monitoring when active exploitation or incident correlation is identified. 
• Partner with Security Engineering which owns vulnerability-scanning platforms integrations technical configuration and platform reliability. 
• Coordinate remediation assignments with technology and application owners maintain the vulnerability ticket flow track progress against defined service levels report overdue exposure and escalate ownership or delivery issues through the established governance process. 
• Maintain operational oversight of vulnerability validation prioritization ticketing remediation follow-up SLA reporting and escalation; remediation execution remains with the technology or application owner responsible for the affected asset or service. 

Automation Forensics & Case Management 

• Develop and maintain approved automation workflows scripts and playbooks for alert enrichment investigation authorized response and case consistency. 
• Preserve identity endpoint email cloud network application and audit-log evidence under approved forensic legal-hold integrity and chain-of-custody procedures. 
• Maintain complete case records covering severity affected assets evidence analysis actions decisions communications and closure rationale. 
• Validate incident containment and corrective actions through available telemetry testing or monitoring. 

Breach Identity Third-Party & AI Investigations 

• Support breach investigations by identifying affected repositories records data types individuals business entities and jurisdictions for Legal and Privacy review. 
• Investigate token theft MFA changes privilege escalation malicious application consent mailbox manipulation and compromised user privileged service-principal or workload identities. 
• Investigate third-party supply-chain and AI-related security notifications or suspected misuse and document potential Trupanion exposure. 

Operating Model & Continuity 

• Execute alert triage investigations MDR service monitoring threat-intelligence analysis threat hunting vulnerability validation and prioritization remediation follow-up security metrics and reporting case documentation and authorized security-tool actions. 
• Escalate architecture complex integration detection-platform design routine vulnerability-management administration and permanent engineering needs to Security Engineering. 
• Provide structured handovers of active alerts incidents intelligence investigations and urgent exploitation-driven vulnerability exposures across operating regions. 
• Provide technical evidence to Legal and Privacy and do not independently determine legal privilege regulatory interpretation or notification obligations. 

Qualifications: 

• Bachelors degree in Cybersecurity Information Technology Computer Science Digital Forensics or a related field or equivalent practical experience. 
• 3 years of experience in cybersecurity operations incident response IT operations system administration network security or a related area. 
• Experience investigating alerts using SIEM EDR/XDR identity email cloud network or vulnerability technologies. 
• Knowledge of common attacker techniques phishing malware account compromise privilege misuse lateral movement exfiltration and vulnerability exploitation. 
• Demonstrated experience applying threat intelligence and incident telemetry to vulnerability prioritization and exploitation assessment. 
• Experience with security automation or scripting digital-evidence handling identity investigations third-party incident analysis and structured case management. 

Skills: 

• Experience with Microsoft Defender Microsoft Sentinel Microsoft 365 Azure identity security privileged access management cloud security and endpoint environments. 
• Familiarity with MITRE ATT&CK and common detection threat-hunting and incident-response methodologies. 
• Understanding of vulnerability scanning and remediation workflows and the division of responsibility between vulnerability-program governance threat-led escalation and asset-owner remediation. 
• Knowledge of NIST CSF ISO 27001 PCI DSS NYDFS cybersecurity requirements or privacy and breach-response obligations. 
• Relevant certification such as Security CySA SC-200 GCIH GCIA or equivalent experience is preferred. 

Additional Requirements: 

• Ability to support defined US business-hour coverage and participate in an escalation or on-call rotation. 
• Availability to assist with high-severity incidents outside normal working hours when required. 
• Ability to handle confidential legally sensitive and security-restricted information appropriately.

Compensation: 

• The base salary range for this position is $120000 - $140000 on a full-time schedule. 
• Along with base compensation Trupanion employees are currently eligible for monthly bonuses. 
• We want all employees to be invested in Trupanions success so we grant Restricted Stock Units to all new team members. Our new hire grants vest over 4 years.  

#LI-HYBRID

Additional Information :

Benefits and Perks:

• Full medical dental and vision benefits at no cost to the employee
• Four weeks of paid time off and 9 paid float holidays (you can decide which days are most important to you!)
• Five-week sabbatical after five years of employment
• Open casual pet-friendly and fun office environment
• Free medical health insurance for your pet (1 dog or cat)
• Paid time off to volunteer at nonprofit organizations
• Seattle Office Amenities: Free on-site gym free dog walking services for office pets during business hours free parking and paid ORCA cards.

For more information about Trupanion visit more about how Trupanion has revolutionized our industry and the reimbursement model: is an equal-opportunity employer and embraces diversity. We are committed to building a team that represents a variety of backgrounds abilities perspectives and skills.

We will ensure that individuals are provided reasonable accommodation to participate in the job application or interview process perform essential job functions and receive other benefits and privileges of employment. Please contact us to request accommodations.

Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment visa at this time.

Remote Work :

No

Employment Type :

Full-time