Senior Security Analyst

A Senior Security Analyst works as a senior individual contributor within Threat Response organization. This role is responsible for leading complex alert investigations, validating and responding to security incidents, and supporting real-time decision‑making during high‑severity events.
The analyst will gain a strong working knowledge of Edward Jones’ technology environment, security tooling, and operational processes, and applies that knowledge to quickly assess scope, impact, and appropriate response actions. This role routinely guides junior analysts, contributes to incident response execution, and ensures investigations are thoroughly documented and operationally sound.

What You'll Do:
(Maximum 10, ordered by role criticality)

1. Investigate, validate, and triage security alerts to identify and respond to security incidents, escalating confirmed or high‑risk activity in accordance with Threat Response procedures.
2. Lead in‑depth analysis of host, network, log, file, and identity data to determine incident scope, root cause, and potential impact.
3. Coordinate with incident response partners and technical teams to support containment, remediation, and recovery actions during active security incidents.
4. Provide real‑time analytical input to Threat Response leadership during high‑severity or time‑sensitive incidents to support rapid decision‑making.
5. Ensure all investigations, actions, and outcomes are accurately documented in case management systems to meet operational, audit, and legal requirements.
6. Mentor and support junior Threat Response analysts by reviewing investigations, providing guidance on analysis techniques, and reinforcing consistent investigation standards.
7. Maintain a strong understanding of the Edward Jones environment, common attack patterns, and adversary techniques relevant to Threat Response operations.
8. Contribute to continuous Threat Response improvement by identifying gaps in alerting, investigation workflows, and response procedures based on incident experience.
9. Participate in incident after‑action reviews and exercises, providing operational insights and recommended improvements to Threat Response processes.
10. Maintain proficiency in SOC tooling, including SIEM platforms (e.g., Splunk, Microsoft Sentinel, LogRhythm) and case management/orchestration tools (e.g., ServiceNow, Swimlane, XSOAR).

• Education: Bachelor's degree in information systems or related field preferred, or equivalent work experience.
• Related Experience: Minimum of 5 years Information Systems Security experience, or 7 years of Information Technology experience with a focus on security controls and processes.
• Promptly investigate routine security alerts to identify security incidents or threat detection opportunities, escalating as appropriate.
• Promptly collect, review and report on cyber threat trends and support in the development of comprehensive detection coverage for them.
• Perform routine host, vulnerability, network, file, and log analysis from a variety of sources and platforms to support the incident response, threat detection, and hunt lifecycles.
• Properly document/track all security investigations and work to meet department, audit, and legal requirements.
• Maintain knowledge and understanding of the Edward Jones environment in support of comprehensive threat intelligence, incident response, and threat detection activities.
• Maintain knowledge and understanding of current security threats and vulnerabilities and of how threat actors execute common attack paths. Ensure timely and accurate collection of this threat intelligence data for analysis and reporting purposes.
• Contribute to the team's processes and documentation by suggesting opportunities to incorporate industry best practices and lessons learned from previous events.
• Participate in after-action reviews for security incidents and red team exercises.
• Effectively communicate with peers and leadership to ensure awareness of progress and challenges.
• Remain current on the use of security and incident event management (SIEM) tools such as: Splunk Security Analytics, Microsoft Sentinel, LogRhythm, etc; threat intelligence platforms such as: ThreatQuotient, Anomali, ThreatStream, etc and case management tools such as: ServiceNow, Swimlane, XSOAR, etc.

Edward Jones does not discriminate on the basis of race, color, gender, religion, national origin, age, disability, sexual orientation, pregnancy, veteran status, genetic information or any other basis prohibited by applicable law.