Principal TDR Analyst

About WFS

Join our Worldwide Flight Services family and contribute to the timely delivery of cargo shipment, luggage, business-to-customer delivery, and on-time flights while operating safely and securely. We perform at the highest level for our customers every day, striving to be an exceptional leader in our industry with our teams of cargo, passenger, ramp handling, and technical service experts in 227 airport locations across 27 countries on 5 continents. WFS employs over 22,200 professionals in ground handling across a global network of more than 170 locations and 22 countries. A career with us offers opportunities to develop existing skills, learn new ones, and experience working with diverse customers and cultures.

About the Role

The Cyber Security Principal TDR Analyst is a subject matter expert serving as a senior threat detection and response analyst. This role focuses on detection, incident response, tuning, automation, and threat hunting, supporting a global organization with team members in North America, EMEA, and APAC. The position combines technical expertise with mentoring, leading complex investigations, implementing automation, and continuously improving knowledge and skills. A background in systems and network engineering is ideal.

Responsibilities

• Lead investigations into complex events, determine the scope and severity of incidents, escalation needs, urgency, and gather relevant evidence.
• Perform incident root cause analysis, identify attack vectors, and affected systems.
• Execute incident response actions end-to-end, including rapid containment of threats, eradication of malicious artifacts, and system restoration.
• Lead threat hunting operations across a global, distributed technology environment.
• Proactively hunt for indicators of compromise and hidden threats in logs, network traffic, and endpoint telemetry using hypothesis-driven techniques and knowledge of attacker behavior.
• Continuously tune SIEM/EDR detection rules, thresholds, and automation playbooks to automate repetitive response actions.
• Leverage threat intelligence to enrich analysis and response, staying updated on new vulnerabilities and adversary tactics to adjust monitoring rules and detection strategies.
• Conduct proactive threat hunting to map adversary techniques, uncover stealthy threats, and close gaps in standard detection coverage.
• Coordinate with cross-functional teams (IT, DevOps, Business, etc.) during high-impact incidents, translating complex technical findings into clear, actionable insights for non-technical stakeholders.
• Collaborate with global SOC team members and colleagues in other regions (e.g., joint investigations or hand-offs) to ensure seamless coverage and knowledge sharing.
• Document repeatable investigation steps, findings, and actions taken for each incident type clearly and concisely. Prepare incident reports and contribute to post-incident review meetings, highlighting what occurred, how it was resolved, and recommendations to prevent future occurrences.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or equivalent threat management & incident response experience.
• Currently hold cybersecurity certifications such as GCIH, GCFA, GCIA, CEH, etc.
• 10 years of progressive experience in at least three of the following disciplines:
  • Threat Detection & Analysis
  • Incident Response & Management
  • Threat Hunting
  • Cyber Threat Intelligence
  • Network Security
  • Securing and monitoring operating system and cloud environments
• Function as a Level 3 SOC Analyst (analyzing and responding to cybersecurity incidents).
• Advanced understanding of emerging threats, zero-day vulnerabilities, and common attack vectors (phishing, malware, ransomware, lateral movement) with the ability to ensure rapid detection and response.
• Hands-on experience using SIEM and EDR platforms for centralized log analysis, real-time threat monitoring, and in-depth incident investigations.
• Proficiency at the command line (win/*nix) and in applying scripting languages for data analysis and investigations.
• Familiarity with cyber threat intelligence feeds and standards, incorporating indicators and threat intel into monitoring operations to enrich context and anticipate emerging threats.

Physical Requirements / Working Conditions

• Some domestic travel for project rollouts and NA IT group meetings (~10%).
• Remain in a stationary position 50% of the time.
• Constantly operate a computer and other office productivity machinery.
• Handle/grasp documents or office equipment.
• Sit and/or stand for short or extended periods.
• Work in an office environment using standard office equipment.
• Talk, listen, and speak clearly on the telephone.

Benefits

• Access your pay in advance through the DailyPay app.
• On-the-spot awards through the Awardco Platform, including gift cards and more.
• Multiple medical care options for both full and part-time employees.
• WFS Employee Extras: travel discounts, pet insurance, discount shopping, and more.
• Wellness programs offered to all employees.
• 401k program for future investment.
• Opportunities for internal mobility and career growth.