Remote Position
Senior SOC Analyst – Vehicle & API Security
🌍 Remote · United States
💼 Full-time
About the position Upstream Security is hiring a Senior SOC Analyst for its managed cybersecurity services team. The role investigates and responds to cybersecurity incidents involving connected vehicles, mobility applications, backend services, and APIs. The analyst serves as a security focal point for customers, leads complex investigations, improves detection capabilities, and helps deploy and maintain agentic AI workflows used in SOC operations. This is a full-time, hybrid position based in Michigan, USA.
Responsibilities
- Monitor, investigate, and respond to vehicle and API security alerts.
- Lead complex investigations, assess impact, identify root causes, and provide actionable mitigation recommendations.
- Analyze suspicious vehicle behavior, API activity, authentication events, and mobility-related telemetry.
- Investigate API threats, including authorization abuse, credential attacks, injection, data exposure, automation, and business-logic abuse.
- Deploy, configure, test, and maintain agentic AI workflows supporting alert triage, investigations, threat hunting, reporting, and response.
- Monitor the accuracy, reliability, and operational performance of AI-driven workflows and improve their prompts, tools, guardrails, and decision logic.
- Conduct proactive threat hunting and OSINT investigations to identify emerging threats and attack patterns.
- Develop and maintain investigation playbooks, operational procedures, and response processes.
- Tune detection logic, behavioral profiles, and machine-learning models to improve detection quality and reduce false positives.
- Produce investigation reports, incident updates, dashboards, and executive-level summaries.
- Act as a trusted security advisor to customers during investigations, workshops, and business reviews.
- Mentor analysts and promote consistent investigation quality across the SOC.
- Track operational performance against SLAs, quality standards, and SOC KPIs.
- Collaborate with threat intelligence, research, product, engineering, and customer-facing teams to improve Upstream’s security capabilities.
Requirements
- At least 3 years of experience in SOC operations, incident response, threat hunting, or security investigations.
- Previous customer-facing analyst experience, preferably within an MSSP, consulting, or professional services context.
- Strong practical understanding of APIs, including REST, authentication, authorization, OAuth, and JWT.
- Hands-on API security experience with technologies such as WAFs, API gateways, API security platforms, SIEM, Burp Suite, or similar tools.
- Experience investigating common API threats, including account abuse, authorization flaws, injection, data exposure, and business-logic attacks.
- Experience with SIEM, SOAR, XDR, security automation, and large-scale data analysis.
- Experience deploying or maintaining automation, AI-assisted, or agentic AI workflows.
- Scripting experience, preferably with Python or SQL.
- Ability to lead complex investigations and operate effectively in high-pressure environments.
Nice-to-haves
- Experience in automotive, mobility, IoT, cloud security, mobile application security, or managed security services.
- Customer-facing analyst experience in English.