Defensive Security Analyst

What we're looking for:

We need someone with 2-5 years of experience in security operations who has hands-on incident response and detection engineering skills. You should be comfortable working in a cleared (TS/SCI) environment, operating on Linux systems, and navigating AWS cloud infrastructure. Bonus points if you've done memory forensics, threat hunting, or have a systems engineering/administration background.

What you'll do:

Rotate through on-call incident response shifts, triaging human-generated tickets and driving security incidents to resolution

Triage and analyze machine-generated alerts from our SIEM (Splunk) and custom alerting platforms, identifying real threats from noise

Build and maintain detection logic and alerting strategies across cloud-based infrastructure (primarily AWS and Linux)

Conduct focused threat hunting exercises across network segments to identify existing compromises and develop new detections

Perform host forensics, memory forensics, network forensics, and log analysis in support of investigations

Write automation to accelerate alert triage and incident response workflows

Onboard new log sources and engineer detection coverage for new infrastructure components

Collaborate closely with cloud infrastructure and cloud ops teams operating in the high-side environment

Contribute to the broader Palantir security operations mission beyond the USG-specific team

Write clear technical summaries of security incidents for distribution to senior stakeholders