Senior Security Analyst I

DigitalOcean is looking for a highly experienced Senior Security Analyst who is passionate about advanced security monitoring, detection engineering, and threat hunting. You will lead and own critical aspects of the security monitoring program, shaping how the company detects, responds to, and prevents threats. You will engineer sophisticated detection capabilities, develop metrics to measure program effectiveness, and drive continuous improvement across alerting and response functions as a trusted member of Infrastructure Security.

Key Responsibilities:

• Lead real-time monitoring, triage, and analysis of complex security events, providing verifiable assessments of threats and incident severity.
• Engineer and automate advanced detection use cases across cloud and corporate environments, leveraging deep knowledge of adversary TTPs to design scalable alerting solutions.
• Develop, track, and report on key metrics for monitoring effectiveness and incident response performance, using data to drive improvements.
• Own and evolve the security monitoring program strategy, ensuring alignment with evolving threat landscapes and business priorities.
• Work closely with Infrastructure Security Engineers to identify log sources and maintain data pipelines (forwarders, parsing, enrichment).
• Perform proactive threat hunting and hypothesis-driven investigations to uncover hidden or emerging threats.
• Mentor and guide analysts, reviewing escalated incidents and providing technical leadership during incident response.
• Optimize security tools and processes to reduce false positives, improve detection fidelity, and automate response workflows.
• Lead the creation and maintenance of detailed playbooks, runbooks, and documentation to standardize detection and response efforts.

Qualifications:

• 5+ years of hands-on experience with SIEM platforms and endpoint detection tools, with proven impact on security monitoring programs.
• Demonstrated expertise designing and tuning complex detection rules and alerting logic across diverse environments.
• Deep understanding of network and endpoint security, attack methodologies, threat actor tactics, and mitigation strategies.
• Experience in proactive threat hunting, vulnerability management, and coordinating with red teams or penetration testers.
• Proven experience with scripting and query languages (Python, Bash, SQL) to automate detection and response workflows.
• Demonstrated proficiency in Linux, Windows, and macOS, and excellent communication skills for technical documentation, incident reporting, and mentoring.