Position Summary:At JetBlue, cyber security operates across a complex IT environment, encompassing traditional data centers, Software as a Service (SaaS) services, multiple cloud providers, e-commerce platforms, and a diverse end-user environment.We are seeking an experienced Incident Response Analyst to support the Cyber Security Incident Response function through escalated alert triage, investigation, containment support, and response activities. The ideal candidate has hands-on experience analyzing security telemetry across multiple tools, can work independently through ambiguous investigations, and can clearly document findings, risk, and recommended next steps.Essential Responsibilities: Monitor, triage, and investigate escalated security alerts and cases from internal tools, managed security providers, and other reporting channels. Analyze telemetry from multiple sources, including SIEM, endpoint detection and response tools, identity platforms, email security tools, cloud platforms, network devices, CDNs, and WAF technologies. Investigate suspicious or malicious activity, including phishing, malware, suspicious authentication, anomalous network activity, unauthorized access, endpoint compromise, and potential data exposure. Perform investigative scoping to identify affected users, hosts, accounts, applications, indicators, timelines, and potential business impact. Support incident response activities, including evidence gathering, containment support, remediation validation, and communication of technical findings. Execute approved response actions in accordance with established procedures, including account, endpoint, email, URL/domain, or indicator-based response steps. Create clear, defensible case notes and incident documentation, including observed activity, entities involved, timeframe, scope, conclusion, and remediation or follow-up actions. Collaborate with Threat Intelligence, Detection Engineering, Security Monitoring, IT Operations, Identity, Infrastructure, application teams, and other stakeholders during investigations. Identify detection gaps, logging gaps, process breakdowns, recurring alert patterns, and opportunities to improve security monitoring and response capabilities. Build or support dashboards, searches, playbooks, reports, process documentation, and other operational improvements that improve incident response efficiency and quality. Provide guidance and support to less experienced analysts during triage, investigation, documentation, and escalation activities. Other duties as assigned.Minimum Experience and Qualifications: Bachelor's Degree in Cyber Security, Computer Science, Information Technology, or other relevant discipline; OR demonstrated capability to perform job responsibilities with a High School Diploma/GED and at least four (4) years of previous relevant work experience on a SOC, Incident Response, Threat Detection, or cyber security operations team. Three (3) years of hands-on experience performing alert triage, security investigations, incident response support, or similar technical security operations work. Demonstrated ability to analyze disparate data sources such as network logs, endpoint activity, authentication logs, cloud logs, email data, and SIEM events to assess suspicious or malicious activity. Experience investigating common security events such as phishing, malware, suspicious logins, anomalous network traffic, unauthorized access, suspicious process execution, or endpoint compromise. Ability to assess risk, determine likely impact, scope activity, and make appropriate escalation recommendations based on available evidence. Strong problem-solving and analytical skills, including the ability to work through ambiguous or incomplete information. Ability to demonstrate a high level of critical thinking and sound judgment during technical investigations. Ability to pass a live skil
