Information Security Analyst

We're looking for an Information Security Analyst to be a core contributor to our security operations and incident response capabilities. In this role, you'll own the day-to-day SOC workload — triaging and resolving security alerts, investigating incidents, and executing response playbooks — while also taking on moderate-complexity incident response investigations with increasing independence. You bring enough experience to work independently on most security events, make sound triage decisions, and know when to escalate. You contribute to playbook improvements, support other analysts, and partner with other teams during incident response.

Responsibilities

Monitor, triage, and resolve tier-1 and tier-2 SOC tickets across endpoints, identity, cloud, network, and application sources; Investigate security alerts from SIEM, EDR, and cloud security platforms, accurately assessing severity and scope; Execute incident response playbooks for scenarios such as phishing, account compromise, endpoint alerts, and cloud alerts; Serve as an escalation point for other analysts, helping guide triage and investigation decisions; Maintain accurate documentation of all investigations, response actions, and outcomes; Lead response on low-to-moderate complexity security incidents, owning investigation from detection through containment, remediation, and post-mortem documentation; Investigate a broad range of incident types including identity attacks, phishing, SaaS events, cloud attacks, supply chain alerts, and endpoint compromises; Conduct forensic analysis of compromised systems across Windows, macOS, Linux, and cloud environments, preserving evidence and documenting findings; Participate in on-call rotation for after-hours security incidents, escalating to senior responders when appropriate; Contribute to post-incident reports and root cause analyses, capturing lessons learned and recommending improvements; Investigate AWS security alerts such as GuardDuty findings, CloudTrail anomalies, IAM events, and compute events; Apply cloud security knowledge to scope and contain incidents in AWS environments, partnering with senior responders and engineers on complex cloud investigations; Analyze threat intelligence and monitor for indicators of compromise relevant to Zillow's environment; Contribute to detection logic refinement and playbook updates based on investigation findings and emerging threats; Participate in tabletop exercises and help identify gaps in the team's response capabilities; Collaborate with detection engineering to tune out false positives and improve alert fidelity; Drive continuous improvement to the cyber defense program through lessons learned, process automation, tooling enhancements, post-incident follow-through and other duties as required; Partner with cloud and platform engineering on containment actions and long-term security hardening recommendations

Requirements

5+ years of experience in cybersecurity, with hands-on experience in security operations, SOC, or incident response; Proven ability to independently investigate and resolve moderate-complexity security incidents — you don't need step-by-step guidance on standard event types; Working knowledge of AWS security services (GuardDuty, CloudTrail, IAM, S3, EC2) and experience investigating cloud-based security events; Proficiency with SIEM platforms (e.g., Exabeam, Splunk) and EDR tools (e.g., CrowdStrike); Solid understanding of attacker TTPs and the MITRE ATT&CK framework, with the ability to apply them during active investigations; Experience investigating identity-based attacks including Okta and AD attacks, phishing, account compromise, and MFA abuse; Understanding of Windows, macOS, and Linux environments and common forensic artifacts — logs, process activity, and persistence mechanisms; Familiarity with scripting (Python, Bash, or PowerShell) for basic automation and investigation tasks; Clear written and verbal communication — you document thoroughly and keep stakeholders informed during incidents; Sound judgment on when to drive to resolution independently versus when to escalate to senior responders

Nice to have

Background in IT systems administration, software engineering, or a technical field — helpful for cross-team collaboration and understanding the environments you're defending; Experience with SOAR platforms or automated response workflows; Relevant certifications: Security+, CySA+, GCIH, GCFR, AWS SSA

Benefits

Competitive base pay; Incentive compensation eligibility