Senior Security Operations Analyst (Detection & Response)

<div class="content-intro"><h3>About Point</h3> <p><strong>✨ Real Impact, Real People:</strong> Our mission at Point is to make homeownership more valuable and accessible. Your work directly helps homeowners access their wealth, achieve financial flexibility, and realize life changing goals.</p> <p><strong>✨ Funding:</strong> With over $175M raised from top investors like Andreessen Horowitz, WestCap, Greylock, and Prudential, we’re scaling fast! You have the opportunity to join us at a pivotal stage.</p> <p><strong>✨ Game-changing Product:</strong> We're building a category defining company in home equity. We’ve earned a 4.7 Trustpilot rating and an A+ from the BBB, a testament to the value we provide to our 20,000+ customers.</p> <p><strong>✨ Great Place to Work:</strong> Our employees love working here! We are a <a href="https://www.greatplacetowork.com/certified-company/7037273">Certified Great Place to Work and a Fortune Best Workplaces in the Bay Area</a>.</p> <p><strong>✨ Remote First Culture, Genuine Connection:</strong> Work from anywhere in the U.S. while staying closely connected through virtual collaboration, team gatherings, and a people-first culture. Select roles may require onsite work at our Palo Alto office one day per week.</p> <p> </p> <p> </p></div><p> </p> <p><strong>Local or 100% Remote<br></strong></p> <p> </p> <p><strong>About the role</strong></p> <p>Point Digital Finance is expanding its Information Security function, and this is the team's first dedicated monitoring and response hire — a high-visibility role with immediate, measurable impact. As Senior Security Operations Analyst (Detection & Response), you will be the second half of an incident-response rotation, partnering directly with the security lead to detect, investigate, and contain threats across a regulated consumer-finance environment that protects the financial data of hundreds of thousands of homeowners. This is not an alert-watching seat: you will engineer the detections, automate the response, and harden how we see our AWS, Google Workspace, and SaaS estate. You'll help stand up a modern detection & response practice from an early-stage footing, with the autonomy to own problems end to end and the mandate to turn noisy alerts into fast, repeatable, well-documented response. If you like building as much as responding — and want your work to directly reduce risk to real people's financial lives — this role is for you.</p> <p>Check out our latest <a href="https://point.com/blog/engineering-wins-at-point-in-2024" target="_blank">Engineering Blog</a> to learn more about why it's a great time to join Point's Engineering team!</p> <p> </p> <p><strong>Your responsibilities</strong></p> <ul> <li><strong>Rotate on-call and lead response:</strong> share the 24/7 on-call and incident-response rotation with the security lead — triaging, investigating, and driving containment of security alerts and incidents.</li> <li><strong>Own response documentation: </strong>build and maintain incident-response runbooks, escalation paths, and post-incident reviews so response is consistent and repeatable.</li> <li><strong>Engineer detections:</strong> build, tune, and maintain SIEM detections, correlation rules, dashboards, and reporting in Coralogix across cloud and identity log sources.</li> <li><strong>Close coverage gaps:</strong> reduce false positives and onboard new log sources to eliminate detection blind spots.</li> <li><strong>Own vulnerability management: </strong>run day-to-day vulnerability management — prioritize findings, coordinate remediation with system owners, and report on risk reduction across cloud and endpoints.</li> <li><strong>Automate response:</strong> develop detection-as-code and lightweight automation/SOAR so common alerts self-triage and response is faster and repeatable.</li> <li><strong>Add operational redundancy: </strong>serve as a redundant administrative and response path so containment is never bottlenecked on a single person.</li> <li><strong>Report and evidence:</strong> produce recurring security metrics and reporting for leadership, and supply control evidence for audits.</li> <li><strong>Apply AI to the workflow: </strong>use AI/LLM tooling to accelerate investigation, correlation, and detection engineering.</li> <li><strong>Improve the program:</strong> contribute to continuous improvement of the security-operations program, tooling, and threat monitoring.</li> </ul> <p> </p> <p><strong>About you</strong></p> <ul> <li>5+ years of experience in security operations, incident response, SOC, or detection engineering (mid-to-senior individual contributor).</li> <li>Hands-on experience running or actively participating in an on-call / incident-response rotation, independently.</li> <li>Strong SIEM skills — authoring and tuning detections, correlation rules, and dashboards (Coralogix, Splunk, Elastic, Microsoft Sentinel, or similar).</li> <li>Practical cloud security experience in AWS and Google Workspace, including identity and log sources.</li> <li>Demonstrated ability to investigate and contain incidents end to end — e.g., phishing/AiTM, account takeover, business email compromise, and cloud/identity threats.</li> <li>Working knowledge of vuln