Sign upLog in

Sr Cyber Defense Ops Specialist

Citizens

Johnston, RI

Apply
JOB DETAILS
SKILLS
Amazon Web Services (AWS), Analysis Skills, ArcSight, Background Investigation, Bash Scripting, Cisco Network Systems, Cloud Computing, Communication Skills, Computer Science, Computer Security, Continuous Improvement, Cross-Functional, Customer Support/Service, Endpoint Security, Equal Employment Opportunity (EEO), GCIA - GIAC Certified Intrusion Analyst, GCIH - GIAC Certified Incident Handler, GCP (Good Clinical Practices), Genetics, Hunting, ISO (International Organization for Standardization), Incident Management, Incident Response, Information/Data Security (InfoSec), Internet Security, Malware Analysis, Medical Conditions, Mentoring, Microsoft Product Family, Microsoft Windows Azure, Military, Network Security, On Call, PCI-DSS, Presentation/Verbal Skills, Problem Solving Skills, Python Programming/Scripting Language, Regulatory Compliance, Regulatory Requirements, Risk, Root Cause Analysis, Scripting (Scripting Languages), Security Analysis, Security Attacks, Security Information and Event Management (SIEM), Security Monitoring, Splunk, State Laws and Regulations, Symantec Endpoint Security, Team Player, Telemetry, Time Management, Training Tools, U.S. National Institute of Standards and Technology (NIST), Use Cases, Windows PowerShell, Writing Skills
LOCATION
Johnston, RI
POSTED
30+ days ago


Description


We are seeking a skilled and proactive Level 2 Cybersecurity Analyst to join our Cyber Defense Operations team. This role is responsible for investigating and responding to security incidents, performing advanced threat analysis, and supporting the continuous improvement of detection and response capabilities. You’ll work closely with junior analysts, threat intelligence, and incident response teams to ensure timely detection and mitigation of security threats across Citizens Bank’s enterprise environment.


Key Responsibilities

+ Investigate escalated security alerts and incidents from Level 1 analysts.

+ Perform root cause analysis and impact assessments of security events.

+ Conduct threat hunting and anomaly detection across enterprise systems.

+ Collaborate with incident response teams to contain and remediate threats.

+ Correlate threat intelligence with internal telemetry to identify emerging threats and attack patterns.

+ Assist in the creation of use cases and offer recommendations for tuning detection rules in SIEM and other monitoring tools.

+ Recommend improvements to incident response playbooks and runbooks.

+ Provide mentorship and guidance to Level 1 analysts.

+ Participate in post-incident reviews and contribute to lessons learned.

+ Represent Cyber Defense in cross-functional security and risk initiatives.




Required Knowledge Areas

+ Deep understanding of network and endpoint security concepts.

+ Knowledge of threat actor tactics, techniques, and procedures (TTPs).

+ Familiarity with the MITRE ATT&CK framework and threat intelligence platforms.

+ Knowledge of regulatory and compliance frameworks (e.g., NIST, ISO, PCI-DSS).




Required Skills

+ Proficient in log analysis, packet capture review, and malware analysis.

+ Strong analytical and problem-solving skills.

+ Experience with scripting or automation (Python, PowerShell, Bash).

+ Effective oral and written communication skills for both technical and non-technical audiences.

+ Ability to work independently and collaboratively in a high-pressure environment.




Qualifications

+ Bachelor’s degree in Cybersecurity, Computer Science, or a related field, or equivalent experience.

+ 2–5 years of experience in cybersecurity operations or incident response.

+ Security certifications such as CySA+, GCIH, GCIA, CEH, or equivalent preferred.

+ Experience with SIEM platforms (e.g., Splunk, Sentinel, QRadar) and EDR tools (e.g., CrowdStrike, Microsoft Defender).

+ Willingness to participate in a rotating on-call schedule or extended hours during critical incidents.




Preferred Experience

+ Hands-on experience with:

+ SIEM Tools: Splunk, ArcSight, Sentinel, QRadar

+ EDR/XDR: CrowdStrike, Microsoft Defender, SentinelOne

+ Network Security: Palo Alto, Cisco, Check Point, FirePower

+ Data Protection: Symantec DLP, Triton, Guardium

+ Threat Intelligence & SOAR Platforms

+ Cloud Security Monitoring: AWS, Azure, or GCP environments




Hours Work and Schedule

+ Work Schedule: Monday - Friday





Some job boards have started using jobseeker-reported data to estimate salary ranges for roles. If you apply and qualify for this role, a recruiter will discuss accurate pay guidance.



Equal Employment Opportunity


Citizens, its parent, subsidiaries, and related companies (Citizens) provide equal employment and advancement opportunities to all colleagues and applicants for employment without regard to age, ancestry, color, citizenship, physical or mental disability, perceived disability or history or record of a disability, ethnicity, gender, gender identity or expression, genetic information, genetic characteristic, marital or domestic partner status, victim of domestic violence, family status/parenthood, medical condition, military or veteran status, national origin, pregnancy/childbirth/lactation, colleague’s or a dependent’s reproductive health decision making, race, religion, sex, sexual orientation, or any other category protected by federal, state and/or local laws. At Citizens, we are committed to fostering an inclusive culture that enables all colleagues to bring their best selves to work every day and everyone is expected to be treated with respect and professionalism. Employment decisions are based solely on merit, qualifications, performance and capability.


Why Work for Us

At Citizens, you'll find a customer-centric culture built around helping our customers and giving back to our local communities. When you join our team, you are part of a supportive and collaborative workforce, with access to training and tools to accelerate your potential and maximize your career growth







Background Check



Any offer of employment is conditioned upon the candidate successfully passing a background check, which may include initial credit, motor vehicle record, public record, prior employment verification, and criminal background checks. Results of the background check are individually reviewed based upon legal requirements imposed by our regulators and with consideration of the nature and gravity of the background history and the job offered. Any offer of employment will include further information.

01/30/2026

About the Company

C

Citizens