Sr Cyber Analyst

Location: Hershey, PA or Remote

How will you fit in the big picture?

The Senior Cyber Analyst is first and foremost an incident responder within Hershey’s Cyber Fusion team. This role leads and supports the investigation, containment, eradication, recovery, and post-incident review of cybersecurity events while partnering across technology, business, legal, privacy, and risk teams.

In addition to incident response, this position leads the SIEM content development program. The Senior Cyber Analyst establishes detection strategy, engineering standards, lifecycle governance, and measures of effectiveness while providing technical direction and quality oversight to contracted content-development resources. The role also contributes across threat intelligence, detection engineering, security monitoring, threat hunting, digital forensics, and the continuous improvement of Hershey’s cyber defense capabilities.

What will you do?

· Lead Cybersecurity Incident Response: Serve as a lead incident responder, coordinating activities across the full incident lifecycle, including triage, investigation, scoping, containment, eradication, recovery, stakeholder communication, and lessons learned. Maintain response readiness through plans, playbooks, and exercises.

· Own the SIEM Content Program: Set the strategy, roadmap, engineering standards, lifecycle governance, and metrics for detection content, including detection coverage, alert quality, and response outcomes.

· Engineer Detections: Design, build, validate, tune, and maintain detections mapped to attacker techniques. Use threat intelligence, incident lessons, risk priorities, and telemetry to drive them.

· Guide MSSP Content Resources: Clarify expected outcomes, review deliverables, and promote knowledge transfer to internal team members.

· Analyze and Hunt: Analyze endpoint, identity, cloud, network, and event-log telemetry. Support threat hunting, intelligence, and monitoring. Partner with platform engineering to improve data quality and coverage.

· Collaborate and Support: Partner with technology, business, legal, privacy, and risk teams. Join the on-call rotation for high-severity incidents outside normal business hours.

Minimum Education & Requirements

Education

Bachelor’s degree in cybersecurity, information security, computer science, information technology, or a related field, or an equivalent combination of education and relevant professional experience.

Experience

3 or more years of relevant cybersecurity experience, including substantial hands-on experience in:

· Cybersecurity incident response and incident lifecycle leadership

· SIEM detection-content engineering

· Threat hunting and security telemetry analysis

· Endpoint, identity, cloud, network, and event-log analysis

· Digital forensics or advanced technical investigations

· Technical program leadership, standards development, or lifecycle governance

Demonstrated experience establishing technical direction, influencing cross-functional partners, communicating during high-pressure incidents, and coaching employees or contracted technical resources is strongly preferred.

Preferred Qualifications

· Experience with CrowdStrike Query Language (CQL), and CrowdStrike NextGen SIEM (LogScale) or similar SIEM platform

· Experience designing, testing, tuning, and maintaining SIEM detection content

· Knowledge of attacker tactics, techniques, and procedures and their application to detection engineering

· Experience with digital forensics, threat hunting, threat intelligence, or exposure management

· Experience leading or providing technical oversight to MSSP or contracted security resources

· Understanding of detection coverage, alert quality, content-health, and response-effectiveness metrics

· Relevant SANS/industry certifications

Benefits and Perks