Cybersecurity Senior Analyst

About the Cybersecurity Team

The Security Engineering team at Thumbtack is focused on enabling innovation at scale by making the secure path the easiest path. We believe strong security is not a blocker to velocity, but a force multiplier when it is designed into systems, platforms, and developer workflows from the start.

We partner closely with Product, Engineering, Platform, and Data teams to shape system design, guide architectural decisions, and evolve Thumbtack’s security posture as the company scales. Through collaboration, automation, and thoughtful tradeoffs, we help ensure Thumbtack can ship fast, innovate boldly, and maintain customer trust.

About the role

As Thumbtack scales, the volume and variety of security telemetry grows with it, spanning cloud infrastructure, SaaS applications, endpoints, and identity systems. We’re looking for a Cybersecurity Senior Analyst to help build and operate a detection and response capability that is fast, high-fidelity, and increasingly automated.

In this role, you’ll be a cornerstone of our day-to-day security operations, treating detections as code, tuning our SIEM for signal over noise, partnering closely with our MDR provider, and automating response workflows so that human attention is reserved for the incidents that matter most. You’ll combine hands-on security operations with an engineering mindset, continuously finding ways to improve our detections, processes, and tooling as Thumbtack evolves.

While security operations will be your primary focus, you’ll also support the broader security program and flex into areas such as GRC, third-party risk, and vulnerability management as needed.

What you’ll do

• Own day-to-day security operations: monitoring, triage, and investigation of security alerts across our production, corporate, and SaaS environments.
• Manage and continuously improve our SIEM: log source onboarding, parsing and normalization, detection rule development and tuning, and cost/coverage optimization.
• Manage our MDR (Managed Detection & Response) partnership: escalation workflows, SLAs, detection feedback loops, and quality of response.
• Lead security incidents end-to-end: triage, scoping, containment, eradication, recovery, and blameless post-incident reviews.
• Build automation that reduces manual toil and response times: SOAR playbooks, detection-as-code pipelines, enrichment integrations, and response scripting.
• Conduct proactive threat hunting informed by threat intelligence and knowledge of Thumbtack’s environment.
• Define, track, and report on operational metrics (e.g. MTTD, MTTR, alert fidelity, coverage against ATT&CK) and use them to drive improvement.
• Apply AI tools to accelerate security operations, and continuously adapt our detections, processes, and tooling to address evolving and novel threats, including AI-related risks.
• Partner with Security Engineering, Platform, IT, and Compliance to close detection gaps and improve our overall security posture.
• Support the broader security program as needed: GRC (audit support, evidence collection, control monitoring), endpoint security, network security, third party risk reviews, vulnerability management (scanning, triage, and remediation coordination), etc.

In order to be successful, you must bring

• 6+ years of experience in security operations, detection & response, or a related security engineering discipline.
• Deep hands-on experience operating and tuning a SIEM, including detection engineering and log pipeline management.
• Experience managing or working closely with an MDR/MSSP partner, including escalation design and holding vendors accountable to quality and SLAs.
• Strong incident response skills across cloud-native environments (AWS and/or GCP), SaaS applications, endpoints, and identity systems.
• Fluency with AI tools in daily security work, and the adaptability to evolve detections, processes, and tooling to address novel and emerging threats, including AI-related risks.
• Scripting and automation proficiency (e.g. Python), with experience building SOAR playbooks, detection-as-code, or similar automation.
• Risk-based, analytical thinking: the judgment to prioritize what matters, tune out noise, and articulate trade-offs between coverage, fidelity, and effort.
• Working familiarity with adjacent security domains, including GRC and compliance frameworks (e.g. SOC 2, PCI DSS), third party risk assessment, and vulnerability management, with the flexibility to support them as needed.
• Excellent written and verbal communication skills, including clear incident communications, and the ability to collaborate effectively with a distributed, primarily US-based team