Security Operations Analyst

Taxwell helps everyday Americans get every tax advantage they deserve by finding credits and deductions they never even knew existed. Our tax preparation software offers easy guidance and ensures your maximum tax refund. We strive to build a team of like-minded experts in both tax and technology who align with our brand purpose, are advocates for our customers and have a fresh, non-traditional approach to the tax industry. The IRM SecOps team is seeking a Security Operations Analyst who thrives in a lean, fast-moving environment, takes ownership of outcomes, and combines hands-on detection and response expertise with strong operational security capabilities. This position supports multiple areas of security operations through the implementation, configuration, and optimization of security tools and integrations, including monitoring, detection tuning, telemetry visibility, and continuous improvement. The role also supports incident response and other security operations activities, including hands-on investigation, containment, remediation, and addressing root causes. RESPONSIBILITIES: Conduct proactive threat hunting and refine detection logic for improved accuracy and context. Implement, configure, and optimize security tools, SIEM integrations, and data connections. Monitor and validate security telemetry to identify visibility gaps and improve detection coverage. Respond to escalated security incidents, performing analysis, containment, remediation, and root cause investigation. Collaborate with IT, cloud, and development teams to strengthen security controls and visibility. Create and maintain detailed incident documentation, timelines, and lessons learned. Continuously improve playbooks, automation, operational processes, and detection effectiveness. Contribute to process and capability development across the team. Assist with onboarding and troubleshooting data sources and connectors within Microsoft Sentinel. REQUIRED QUALIFICATIONS: 5+ years of experience in cybersecurity operations, security operations, incident response, or threat detection. Hands-on expertise with Microsoft Azure security services, including Azure Monitor, Sentinel, and Entra ID. Strong understanding of SIEM operations, telemetry visibility, detection logic, and incident response workflows. Experience with threat hunting, log analysis, and identifying visibility gaps within security monitoring environments. Proficiency in Python and/or PowerShell scripting for automation and operational support. Excellent communication and collaboration skills. Highly self-motivated with the ability to manage priorities and operate independently in a fast-paced environment. PREFERRED QUALIFICATIONS: Hands-on expertise with CrowdStrike Falcon (deployment, configuration, and response). Familiarity with Amazon Web Services (AWS). Familiarity with Defender XDR, Splunk, and osquery. Experience in consulting, finance, or technology environments. Experience with data visualization tools (e.g., Power BI). Certifications such as GIAC, GCFA, or GCFR. Work Environment: On-call rotation is required for after-hours incidents. Occasional weekend work may be needed for critical projects or incident response. Remote (U.S. only) but must be physically located within the continental United States. Expect a nimble, hands-on, high-ownership culture where your contributions have visible impact. At Taxwell, we believe our work benefits from the diverse perspectives of our employees. As such, Taxwell welcomes and celebrates diversity and inclusion and is committed to equal opportunity employment. At Taxwell, you can expect a supportive, open, and inclusive atmosphere and a team that values your contributions. Taxwell is committed to providing an environment of mutual respect where equal employment opportunities are available to all applicants without regard to race, color, religion, sex, national origin, age, disability, marital status, sexual orientation, gender identity, veteran status, and any other status protected under applicable law. Taxwell considers information gathered in the hiring process, including information on this application, confidential, and only shares it on a need-to-know basis or as required by law. If you need assistance or accommodation due to a disability, you may contact us at [email protected] or by calling 828-349-5887 to speak with a member of the HR Talent Acquisition team.