Lead Security Operations Analyst

wurstaEl SalvadorEngineering

Apply on company site

Opens the official wursta careers page

Salary

Not listed

Job type

Full-time

Work mode

Remote

Experience

Lead · 3+ yrs

Posted

29 Sept 2026

Status

Open · checked 8d ago

About this role

Lead Security Operations Analyst is a hybrid role at Wursta based in Quito, Ecuador or El Salvador, combining operational incident response with AI application engineering for candidates with background in security operations. This position suits professionals looking to lead threat monitoring and build automated security workflows in a multi-tenant cloud environment.

Role Overview

The Lead Security Operations Analyst serves in a dual-purpose operational and engineering capacity at Wursta. The professional acts as the primary tier-3 response authority, overseeing real-time threat monitoring, incident management, and SLA delivery across client tenants. Simultaneously, the role functions as an AI Integration and Detection Engineer, utilizing modern AI tools to build automated escalation workflows and integrate custom AI agents into the core application stack.

Key Responsibilities

Lead operational triage, analysis, and prioritization of complex security events across multi-tenant client environments.

Function as the Incident Commander during critical security events, executing containment, eradication, and recovery strategies following NIST SP 800-61r2 guidelines.

Utilize the MITRE ATT&CK Framework for adversary mapping, proactive threat hunting, and writing custom correlation rules like Sigma and YARA.

Ensure incident notifications and responses meet contractual SLAs and regulatory reporting timelines.

Write production-grade Python, Node.js, or Go code to extend backend MSSP application logic using AI development environments and APIs.

Build integrations for third-party security tool telemetry, including EDR, DNS security, threat intelligence, and identity management solutions.

Design automated orchestration playbooks within the MSSP platform for dynamic triage, identity enrichment, and tenant isolation.

Implement AI-driven alert summarize-and-enrichment pipelines using LLM frameworks and RAG pipelines.

Optimize detection pipelines using machine learning and AI filters to lower false positive alert volumes.

Align security monitoring controls with NIST CSF 2.0, ISO/IEC 27001:2022, NIST SP 800-53r5, and data privacy regulations like GDPR and LGPD.

Requirements

Experience with SIEM and XDR platforms such as Splunk, Microsoft Sentinel, Elastic SIEM, CrowdStrike Falcon, SentinelOne, or Palo Alto Cortex XDR.

Knowledge of network and telemetry tools including Wireshark, Zeek, Suricata, PCAP analysis, Syslog, Windows Event Logs, and CloudTrail/CloudWatch.

Proficiency in AI and automation tools such as Python, REST APIs, Cursor IDE, GitHub Copilot, Claude/OpenAI APIs, LangChain, Webhooks, and Docker.

Experience with SOAR and scripting tools including Python, PowerShell, Bash, Demisto/Cortex XSOAR, Shuffle, and Tines.

Familiarity with threat frameworks like MITRE ATT&CK, NIST SP 800-61r2, Cyber Kill Chain, YARA, and Sigma Rules.

Background in cloud environments including AWS, Azure, and GCP security architectures, IAM, and log architectures.

At least one required certification from GIAC (GCIH, GMON, GNFA) or CompTIA/Offensive Security (CySA+, CASP+, OSCP).

Nice to Have

Three or more years of experience in a SOC or MSSP environment, with at least two or more years in a Level 3 or Lead SOC capacity.

Hands-on experience in scripting and API integration for automated incident response playbooks.

Proficiency using AI-assisted coding tools like Cursor and Copilot to build and deploy automation scripts.

Expertise in log analysis across endpoint, identity, network, and multi-cloud environments.

CISSP certification.

Skills and Tools

Python, Node.js, Go, PowerShell, Bash

Splunk, Microsoft Sentinel, Elastic SIEM, CrowdStrike Falcon, SentinelOne, Cortex XDR

Wireshark, Zeek, Suricata, CloudTrail, CloudWatch

Cursor IDE, GitHub Copilot, Claude API, OpenAI API, LangChain, Docker

Demisto/Cortex XSOAR, Shuffle, Tines, REST APIs, Webhooks

MITRE ATT&CK, NIST SP 800-61r2, YARA, Sigma Rules, Cyber Kill Chain

About the Company

Wursta builds operating systems that transform technology investments into measurable value by combining governance, workforce proficiency, and platform delivery. The organization specializes in digital transformation, cloud services, managed services, custom development, cybersecurity, and AI solutions to help clients scale and increase productivity.

How to Apply

Candidates should review the details and apply on the official company careers page.

Questions candidates ask

Where is the Lead Security Operations Analyst position located?

This position is based in Quito, Ecuador or El Salvador in a hybrid environment.

What primary frameworks are used for incident response and monitoring?

The role utilizes NIST SP 800-61r2 for incident handling, MITRE ATT&CK for threat mapping, NIST CSF 2.0, ISO/IEC 27001:2022, and NIST SP 800-53r5.

What certifications are required for this role?

Candidates must hold at least one certification from the following list: GIAC Certified Incident Handler (GCIH), GIAC Continuous Monitoring & Security Operations (GMON), GIAC Network Forensics Analyst (GNFA), CySA+, CASP+, or OSCP.

What is the interview process like at Wursta?

The process includes a work style survey, an initial screen with a hiring coordinator, a deep dive with the hiring manager, a peer session, an interview with senior leadership, and a decision typically delivered within a week.

What programming languages and AI tools are used in the role?

The position involves working with Python, Node.js, Go, PowerShell, Bash, REST APIs, Cursor IDE, GitHub Copilot, Claude and OpenAI APIs, LangChain, and Docker.

Ready to apply?

The application is on the official wursta careers page.