Security Incident Response Analyst

Know where you belong!

Match Group is a leading provider of dating products across the globe. Our portfolio includes Tinder, Hinge, Match, Meetic, PlentyOfFish, OkCupid, The League, HER, and others, each designed to spark meaningful connections for singles worldwide. Creating a sense of belonging doesn’t stop at our products - it’s the foundation of every team we hire.   When it comes to dating, the connection starts online, but the real magic happens once you meet in real life (IRL).  We think the same is true for creating the best platforms, so we work together IRL 3 days/week.

About the Team

The MG Security Engineering organization provides unified security services across all Match Group brands. The Monitoring, Incident Response & SOC team is responsible for real-time threat detection, investigation, and response across the full portfolio — operating 24/7 to ensure security alerts are effectively triaged and responded to, minimizing the impact of potential threats.

About the Role

We're looking for a senior individual contributor to join our Detection & Response team as a Security Incident Response Analyst. In this role, you'll serve as a senior-level investigator responsible for detecting, analyzing, and responding to advanced security threats across on-prem and cloud infrastructure in a multi-vendor environment. You'll lead investigations spanning phishing, malware, insider threats, and other complex security incidents — driving them from initial detection through containment, eradication, and recovery.

What You'll Do

• Lead end-to-end investigations into phishing, malware, insider threats, and other advanced security incidents
• Triage and analyze security alerts, distinguishing true threats from noise, and prioritize response based on risk and business impact.
• Perform technical malware analysis, including static and dynamic examination of suspicious files, to determine behavior, capability, and intent.
• Conduct host and network-based analysis — analyzing system logs, processes, registry/configuration artifacts, memory, traffic patterns, DNS activity, and connection logs — to reconstruct attacker activity and identify persistence, command-and-control, lateral movement, and data exfiltration.
• Investigate cloud-native incidents by analyzing audit logs, IAM and access activity, and network flow data to detect unauthorized access, privilege misuse, and malicious file activities across cloud environments.
• Drive incidents through containment, eradication, and recovery, coordinating with cross-functional teams as needed.
• Develop and refine detection logic, playbooks, and response procedures to improve the team's ability to identify and act on emerging threats.
• Act as an escalation point for the most technically complex cases, mentoring junior analysts.