Senior Security Operations Analyst (Detection & Response)

• Point Digital Finance is expanding its Information Security function, and this is the team’s first dedicated monitoring and response hire — a high-visibility role with immediate, measurable impact
• As Senior Security Operations Analyst (Detection & Response), you will be the second half of an incident-response rotation, partnering directly with the security lead to detect, investigate, and contain threats across a regulated consumer-finance environment that protects the financial data of hundreds of thousands of homeowners
• This is not an alert-watching seat: you will engineer the detections, automate the response, and harden how we see our AWS, Google Workspace, and SaaS estate
• You’ll help stand up a modern detection & response practice from an early-stage footing, with the autonomy to own problems end to end and the mandate to turn noisy alerts into fast, repeatable, well-documented response
• Rotate on-call and lead response: share the 24/7 on-call and incident-response rotation with the security lead — triaging, investigating, and driving containment of security alerts and incidents
• Own response documentation: build and maintain incident-response runbooks, escalation paths, and post-incident reviews so response is consistent and repeatable
• Engineer detections: build, tune, and maintain SIEM detections, correlation rules, dashboards, and reporting in Coralogix across cloud and identity log sources
• Close coverage gaps: reduce false positives and onboard new log sources to eliminate detection blind spots
• Own vulnerability management: run day-to-day vulnerability management — prioritize findings, coordinate remediation with system owners, and report on risk reduction across cloud and endpoints
• Automate response: develop detection-as-code and lightweight automation/SOAR so common alerts self-triage and response is faster and repeatable
• Add operational redundancy: serve as a redundant administrative and response path so containment is never bottlenecked on a single person
• Report and evidence: produce recurring security metrics and reporting for leadership, and supply control evidence for audits
• Apply AI to the workflow: use AI/LLM tooling to accelerate investigation, correlation, and detection engineering
• Improve the program: contribute to continuous improvement of the security-operations program, tooling, and threat monitoring

Benefits

• Health Insurance: Point provides platinum-rated plans for medical (Anthem Blue Cross or Kaiser Permanente), dental and vision (The Standard). We cover 99% of employee premiums and 75% of dependent premiums
• Generous Vacation: Take time for yourself and your family when you want - Point has an unlimited vacation policy
• Continued Learning: We encourage all team members to attend events hosted by our investors, external workshops and conferences. We believe in continuous improvement and want to support employees on their professional journeys
• Family Friendly: Point will top off state applicable PFL earnings, as well as two weeks of fully paid leave to be available after exhaustion of state PFL. In addition, employees will receive 4 weeks: s of fully paid transition time. For the first consecutive four weeks after returning to work following parental leave, and following exhaustion of all other paid leave benefits, the employee may work part-time, meaning two or three days per week, and will receive 100% of regular base pay
• Work From Home Stipends: With employees working remote, Point will provide employees a $50 monthly cell phone stipend and a $50 monthly internet stipend. In addition, we will reimburse up to $150 to help you purchase supplies for your home office.remote, Point will provide employees a $50 monthly cell phone stipend and a $50 monthly internet stipend. In addition, we will reimburse up to $150 to help you purchase supplies for your home office

• If you like building as much as responding — and want your work to directly reduce risk to real people’s financial lives — this role is for you
• Demonstrated ability to investigate and contain incidents end to end — e.g., phishing/AiTM, account takeover, business email compromise, and cloud/identity threats
• Practical cloud security experience in AWS and Google Workspace, including identity and log sources
• Comfortable operating with autonomy on a small team and owning problems end to end
• Hands-on experience running or actively participating in an on-call / incident-response rotation, independently
• Clear written and verbal communication — able to produce runbooks, metrics, and audit-ready documentation
• Working knowledge of vulnerability management and coordinating remediation with engineering teams
• Strong SIEM skills — authoring and tuning detections, correlation rules, and dashboards (Coralogix, Splunk, Elastic, Microsoft Sentinel, or similar)
• Authorized to work in the United States, and able to participate in an off-hours on-call rotation
• Scripting and automation ability (Python or similar) for detection-as-code and SOAR-style workflows
• 5+ years of experience in security operations, incident response, SOC, or detection engineering (mid-to-senior individual contributor)
• Hands-on experience using AI/LLMs for security analysis, investigation, and alert engineering (detection authoring, correlation, tuning, and automation)
• Experience in a regulated financial-services or fintech environment (GLBA, NYDFS Part 500, SOC 2)
• Relevant certifications (e.g., GCIA, GCIH, GCED, GIAC, CySA+, Security+, or AWS Security Specialty)
• Experience standing up detection & response practices from an early or greenfield state