About Lead Bank

Lead is a banking infrastructure platform trusted by the most innovative companies to power complex financial products. We enable fintechs to offer compliant, programmable services like payments, lending, and digital assets at scale. Banking has moved beyond traditional institutions and is now embedded directly into everyday experiences, meaning companies need modern infrastructure that is safe, secure, and operationally sound.

Today, Lead is one of the only API-first, developer-focused partner banks with the financial, regulatory, and legal expertise required to help fintechs succeed. We operate offices in San Francisco, Sunnyvale, and New York City, and an FDIC-insured bank in Kansas City.

Information Security Team at Lead

The Information Security team helps Lead stay nimble enough to move fast without compromising on safety. They own cybersecurity, overseeing detection and response, and building security controls for all data networks, cloud infrastructures, and IT systems. Working closely with the Risk, Compliance, and Audit teams, they ensure Lead meets and stays up to date on all security standards. Scaling the systems that protect Lead and the fintechs we serve requires critical thinking, good judgment, and an ownership mentality. This is a collaborative team of builders who approach problems creatively, constantly iterating to improve the security of our platform.

Role Description

Lead Bank is looking for a Senior Security Analyst to join our Security Operations team. You'll be a core contributor to our detection and response capabilities — building detections, triaging alerts, responding to incidents, and proactively hunting threats across cloud infrastructure, security tooling, and data pipelines. You'll mentor junior analysts and partner with leadership to drive our security posture forward. Your expertise will be vital in navigating the complex regulatory landscape of the banking industry and defending against advanced persistent threats.

In this role you will

Build, tune, and maintain detection rules and alerts in our SIEM, writing queries to identify threats and coverage gaps aligned to MITRE ATT&CK

Own incident response execution end-to-end — containment, eradication, recovery, and lessons learned — including forensic log analysis and post-incident reporting

Monitor and investigate security events across endpoints, cloud (AWS), identity, and network telemetry — identifying misconfigurations, anomalous activity, and suspicious behavior

Assist with security audits and regulatory examinations, ensuring timely and accurate security documentation and evidence is provided

Analyze systems, applications, and networks for security configurations in partnership with security engineers.

Manage log pipelines including ingestion, parsing, normalization, and enrichment to ensure high-fidelity data is available for detection and investigation

Triage and prioritize vulnerability findings using risk-based frameworks and track remediation SLAs with IT and Engineering

Collaborate with Engineering on IaC and CI/CD security reviews, and contribute to runbooks and playbooks

Perform all other duties as assigned

What we are looking for

Required

5+ years in information security or security operations

Hands-on SIEM experience with query writing, detection building, and alert tuning

Strong working knowledge of cloud security concepts and services (AWS preferred; GCP and Azure also considered)

Proficiency working with logs across endpoint, cloud, network, identity, and application sources

Understanding of CI/CD pipelines and IaC (Terraform, CloudFormation) from a security perspective

Solid grasp of Windows, macOS, and Linux internals — processes, persistence mechanisms, and attacker TTPs

Demonstrated IR experience, including leading or contributing to investigations

Familiarity with data normalization, log parsing, and ETL concepts

Strong written and verbal communication skills

Preferred

Experience with log routing, transformation, and enrichment

Hands-on experience with an enterprise EDR/XDR platform and its ecosystem tooling — SOAR, exposure management, and identity protection