Cybersecurity Monitoring & Response Analyst - Mid Level

About the role

USAA's mission is to empower members to achieve financial security through highly competitive products, exceptional service, and trusted advice, striving to be the #1 choice for the military community and their families. Core values – honesty, integrity, loyalty, and service – guide how we treat each other and our members. The Cybersecurity Monitoring & Response Analyst - Mid Level detects, investigates, and responds to security events, ensuring potential threats are rapidly identified and mitigated through continuous monitoring, case management, and decisive response actions using a variety of cyber defense tools. The role conducts vulnerability, security configuration, and/or penetration testing assessments of systems and networks; identifies cyber threats, analyzes operational impacts, and communicates findings to appropriate stakeholders; and stays current with the latest information security threats, exploits, trends, and intelligence. This position can be based in San Antonio, TX; Plano, TX; Phoenix, AZ; or Colorado Springs, CO. Relocation assistance is not available for this role.

Responsibilities

• Maintain awareness of the latest critical information security vulnerabilities, threats, and exploits.
• Monitor internal and external networks, systems, and applications for security anomalies and events (e.g., suspicious behavior, attacks, security breaches).
• Assist in responding to cyber incidents, performing moderately complex analysis using security tools.
• Build a broad range of knowledge, understanding, and experience (e.g., forensics, networking, servers, coding) to determine a malicious actor's tactics, techniques, and procedures.
• Assist in conducting routine vulnerability management, security configuration assessments, and/or penetration testing operations.
• Under direct supervision, use discoveries from the incident response process to make basic improvements to existing detection capabilities and security controls.
• Document findings of completed alerts and assist with incident documentation.
• Serve as a resource to team members on escalated issues of a routine nature.
• Ensure risks associated with business activities are effectively identified, measured, monitored, and controlled in accordance with risk and compliance policies and procedures.

Requirements

• Bachelor's degree OR 4 years of relevant education and/or experience.
• 2 years of related experience in Information Security, Cybersecurity, and/or Information Technology with a security focus, including accountability for moderately complex tasks and/or projects.
• 1 year of related experience in one of the following domains: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communications and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, Software Development Security.
• Availability to work during non‑standard business hours, including holidays and weekends.
• Developing level of business acumen in the areas of business operations, risk management, industry practices, and emerging trends.

Skills

• Experience working in a Security Operations Center (SOC), cybersecurity operations, or related IT security environment.
• Experience monitoring, triaging, investigating, and responding to cybersecurity alerts, events, and incidents.
• Experience using Endpoint Detection and Response (EDR) platforms (e.g., CrowdStrike, Microsoft Defender for Endpoint) to investigate suspicious activity and support incident response.
• Experience analyzing security events across Windows, Linux, and macOS environments.
• Experience with security monitoring, log analysis, and SIEM technologies (e.g., Splunk, Elastic, Microsoft Sentinel) or similar platforms.
• Knowledge of cyber threat hunting, threat intelligence, MITRE ATT&CK, adversary tactics and techniques (TTPs), or digital forensics concepts.
• Experience with scripting or automation using Python, PowerShell, or similar technologies.
• Ability to participate in shift work, on‑call rotations, weekends, holidays, or other non‑standard business hours in support of 24x7 security operations.
• Familiarity with cloud security monitoring, identity‑based threats, and investigating suspicious activity within Azure, AWS, Microsoft 365, or similar platforms.

Benefits

USAA offers best‑in‑class benefits supporting physical, financial, and emotional wellness, including comprehensive medical, dental, and vision plans; 401(k); pension; life insurance; parental benefits; adoption assistance; paid time off program with paid holidays plus 16 paid volunteer hours; various wellness programs; and career path planning and continuing education to assist with professional goals.

Pay

The salary range for this position is $77,120 – $147,390. Actual salary varies by location and is based on experience and market data. Employees may be eligible for pay incentives based on corporate and individual performance at the discretion of the USAA Board of Directors.

Schedule

This role requires attendance in the office four days per week. A flexible work environment is available, including remote or hybrid options for active‑duty military spouses consistent with applicable policy and business needs.