Lead Analyst - Cyber Security Operations (Remote)

Summary -----------

The Opportunity

Hyatt Hotels Corporation seeks an enthusiastic Lead Analyst – Cyber Security Operations to join our Cyber Security Department. In this role, you will be collaborating closely with the broader Digital & IT team, where you’ll be instrumental in continuing to make Hyatt a leading hospitality company.

You will be part of a team that is passionate about our purpose, committed to nurturing curiosity and new skills, and building connections across the organization with colleagues, customers, and guests.

Who We Are

At Hyatt, we believe in the power of belonging and creating a culture of care, where our colleagues become family. Since 1957, our colleagues and our guests have been at the heart of our business and helped Hyatt become one of the best and fastest-growing hospitality brands in the world.

Our transformative growth and the addition of new hotels, brands, and business lines can open the door for exciting career and growth opportunities for our colleagues.

As we continue to grow, we never lose sight of what’s most important: People. We turn trips into journeys, encounters into experiences, and jobs into careers.

Why Now?

This is an exciting time to be at Hyatt. We are growing rapidly and are looking for passionate changemakers to be a part of our journey. The hospitality industry is resilient and continues to offer dynamic opportunities for upward mobility, and Hyatt is no exception.

How We Care for Our People

What sets us apart is our purpose—to care for people so they can be their best. Every business decision is made through the lens of our purpose, and it informs how we have and will continue to support each other as members of the Hyatt family. Our care for our colleagues is the key to our success.

We’re proud to have earned a place on Fortune’s prestigious 100 Best Companies to Work For® list since 2013. This recognition is a testament to the tremendous way our Hyatt family continues to come together to care for one another, our commitment to a culture of inclusivity, empathy, and respect, and making sure everyone feels like they belong.

We’re proud to offer exceptional corporate benefits which include:

• Annual allotment of free hotel stays at Hyatt hotels globally
• Flexible work schedule
• Work-life benefits including wellbeing initiatives such as a complimentary Headspace subscription, and a discount at the on-site fitness center
• A global family assistance policy with paid time off following the birth or adoption of a child as well as financial assistance for adoption
• Paid Time Off, Medical, Dental, Vision, 401K with company match

Who You Are

As our ideal candidate, you understand the power and purpose of our culture of care, and embody our core values of Empathy, Inclusion, Integrity, Experimentation, Respect, and Wellbeing. You enjoy working with others, are results-driven, and are looking for a variety of opportunities to develop personally and professionally.

The Role

At Hyatt Hotels, Cyber Security is an essential component of our mission to take care of people so they can be their best. The Lead Analyst - Cyber Security Operations plays a crucial role in completing that mission every day by ensuring the global security of our guests, colleagues, and hotels.

As the most senior individual contributor on the Cyber Security Operations team, the Lead Analyst will be responsible for providing technical expertise and coordinating incidents Response engagements.

Your day-to-day responsibilities will include triaging and investigating security alerts, proactive threat hunting, responding to incidents, building detections, and documenting procedures and playbooks.

You will drive measurable improvements in Cyber Security Operations outcomes, including faster detection and containment of high-severity threats, reduced incident impact and recurrence, and more effective coverage of priority attack scenarios; use validated results to guide operational priorities and report progress.

This highly technical role will have a high degree of visibility throughout the organization and will have a deeply meaningful impact on the safety and security of guest and colleague data.

Responsibilities

• Respond swiftly to Cyber Security incidents as they are detected, ensuring that attackers are are removed from the environment, and Hyatt’s operations are restored with minimal disruption
• Lead incident response engagements for Cyber Security and Data Privacy incidents speaheading the triage, containment, eradication, recovery, evidence preservation, post-incident reviews, and corrective actions
• Act as subject matter expert in analyzing detections on endpoints, cloud, SaaS & AI
• Perform forensic analysis, timeline reconstruction, identifying telemetry gaps, and detection engineering
• Perform AI/Agentic SOC responsibilities, such as:

o AI-assisted investigations, enrichment, hunting, and documentation

o Working with supervised security agents and semi-autonomous workflows

o Validating AI outputs and identifying hallucinations or missing context

o Measuring AI effectiveness through accuracy, traceability, escalation quality, action success, and time savings

• Identifying gaps in Hyatt detection pipeline and work on building new detections
• Perform proactive threat hunting searches looking for signs of intrusion in both the Hyatt and Hyatt Franchise environments
• Act as senior-most technical resource for the SOC, develop intimate knowledge of the computing environment and use that knowledge to differentiate legitimate from illegitimate behaviors
• Prepare and present updates for senior leadership on cyber defense program performance
• Review past incident response performance with Security Operations team to identify potential program improvements
• Act as the Point of escalation for operations/security issues
• Must be willing to work off-shift hours, as needed, during incidents. Must also be available for on-call rotation
• Demonstrate a commitment to Hyatt core values

A successful candidate would possess these skills:

• Proven ability to lead and coordinate a team of analysts
• Strong communication skills, including delivering findings and updates to technical and non-technical teams
• Ability to make sound, timely decisions during high-severity or ambiguous incidents
• Ability to manage competing priorities across ticket queues, escalations, and personnel needs
• Strong coaching and mentoring skills to develop L1 and L2 Analysts
• Ability to build and sustain professional relationships across internal and external stakeholder groups
• Meticulous attention to quality, demonstrated through high-quality documentation
• Ability to lead process-improvement initiatives and own runbook/playbook governance
• Ability to remain composed and provide clear direction during critical incidents
• Ability and willingness to operate in a fast-paced, complex corporate environment
• Ability to be on call for cyber incidents impacting the organization
• Ability to travel approximately 5% of work time

Qualifications

------------------

Experience Required:

• Minimum of five years’ experience in the Cyber Security Operations, or Incident Response
• Extensive knowledge of Advanced Persistent Threats (APT) tactics, technics and procedures
• Deep knowledge of the TCP/IP and OSI network stack and its protocols
• Technical skills associated with Crowdstrike CQL, SPL, KQL, SQL, Python, PowerShell & SOAR
• Familiarity with cutting-edge security technologies such as Zero-Trust Network Access, FIDO 2.0, Endpoint & Extended Detection and Response (EDR/XDR), Web Security Gateways (WSG), Email Security Gateways (ESG), Web Application Firewall (WAF), sandboxes, network- and host- based firewalls, Threat Intelligence, Penetration Testing, etc
• Experience working in a high-intensity threat actor environment
• Experience preparing and presenting status updates for executive leadership
• Experience reviewing and updating Cyber Security Incident Response documentation and time reconstruction
• Knowledge of SaaS, Cloud, information systems terminology, controls, and practices
• Strong verbal and written communication and presentation skills
• Ability to effectively interact with different areas and level of the organization, including executive leadership
• Proactive self-starter with ability to work independently and as part of a larger team
• Familiarity with threat hunting and adversary tactics and techniques (i.e., MITRE ATT&CK, Cyber Kill Chain)
• Familiarity with threat response frameworks (i.e., SANS PICERL, NIST SP 800-61)
• Familiarity with cyber and privacy regulatory requirements (i.e., SEC cybersecurity disclosure rules, CCPA/CPRA, GDPR)
• GIAC - Global Certified Incident Handler (GCIH), or any of the equivalent GIAC, ISC2, ISACA, CompTIA or EC-Council certification

Experience Preferred:

• A bachelor’s degree or better in Cyber Security, Information Systems, or any other security-related subject is preferred; however, any combination of education, experience, and certification that demonstrates the candidate can be successful in the position is acceptable.

The position responsibilities outlined above are in no way to be construed as all-encompassing. Other duties, responsibilities, and qualifications may be required and/or assigned as necessary.

We welcome you

Research shows that individuals tend to apply to jobs only if they meet all the listed job qualifications. Unsure if you check every box, but feeling inspired to enhance your career? Apply.

We’d love to consider your unique experiences and how you could make Hyatt even better.

The salary range for this position is $120,000 - $160,000

The final pay rate/salary offered to the successful candidate will depend on experience, skill level and other qualifications for the role, as well as the location of the performance of work. Pay for the successful candidate will meet local requirements, including the local minimum wage rate.

We value our relationships with recruitment partners and require that agencies contact us first before submitting any candidates. Hyatt will not be responsible for any fees and obligations associated with unsolicited submissions unless a formal agreement is in place.