Security Incident Response Analyst

About Box

Box, a leader in Intelligent Content Management since 2005, offers a platform that enables organizations to collaborate effectively, manage content lifecycles, secure critical information, and transform business workflows with enterprise AI integration. Headquartered in Redwood City, CA, with global offices, Box empowers companies like JLL, Morgan Stanley, and Nationwide to succeed in the AI-driven business era.

Role Overview

As a Security Incident Response Analyst at Box, you will play a pivotal role in safeguarding the security and privacy of our customers, partners, and employees. Your responsibilities include spotting, investigating, and addressing security threats that could affect our platform and client organizations. You'll collaborate within a high-performing security team to enhance incident response readiness and maintain Box's reputation as a trusted enterprise partner.

Responsibilities

• Continuously monitor security alerts and events using SIEM and other detection technologies to detect potential threats and irregular activities.
• Lead comprehensive incident response efforts encompassing initial evaluation, containment, mitigation, and post-incident assessment.
• Perform thorough forensic investigations on endpoints, system logs, and network traffic to ascertain the extent and origins of security incidents.
• Develop, update, and optimize incident response playbooks and protocols to enhance efficiency and consistency.
• Work closely with Engineering, Legal, and Compliance teams to manage incidents in line with regulatory standards and company policies.
• Analyze security data to detect trends and emerging threats, providing recommendations for improving detection and prevention measures.
• Support threat intelligence initiatives by researching adversaries’ tactics, techniques, and procedures relevant to Box’s threat environment.
• Participate in an on-call rotation, remaining accessible to address and investigate incidents as they occur.

Qualifications

• A minimum of three years’ experience in security operations, incident response, or a related cybersecurity area.
• Proven expertise working with SIEM platforms such as Splunk or Chronicle, and endpoint detection and response (EDR) tools.
• Strong skills in log analysis, digital forensics, and network traffic examination.
• In-depth understanding of attack frameworks like MITRE ATT&CK and ability to apply them to practical investigations.
• Effective communication skills for composing detailed incident reports and engaging with both technical and non-technical stakeholders.
• Possession of or active pursuit of relevant cybersecurity certifications (e.g., GCIH, GCFE, GCFA, CEH, or comparable credentials).

Work Environment and Culture

Box values diverse experiences and inclusive collaboration. Employees are expected to work onsite at least three days per week, supporting a culture of community engagement. The company promotes equal employment opportunity and provides reasonable accommodations to applicants with disabilities. Notices related to employment practices in Los Angeles and San Francisco are observed in compliance with local ordinances.

Compensation

The salary range in the United States for this role is from $78,500 to $95,000 USD annually, with actual compensation determined by experience, skills, and location. Eligible candidates may also receive equity and other benefits.