Cyber Defense SOC Analyst

Zillow Groups Cyber Defense team owns security monitoring detection engineering incident response and vulnerability management across our environment. We partner closely with Engineering IT Legal Privacy and business stakeholders to keep Zillows customers employees and data safe.

Zillow Group is a strategic mission-driven organization focused on delivering exceptional experiences and measurable outcomes. Our work spans cross-functional partnership scalable programs and operational excellence in support of Zillows mission. We bring deep experience working across diverse teams in a dynamic high-growth environment balancing strategic thinking with hands-on execution to drive meaningful business impact. We are seeking an experienced professional to support our workforce expansion in India.

You Will Get To:

Security Operations

• Monitor triage and resolve SOC tickets across endpoints identity cloud network and application sources.

• Investigate security alerts from SIEM EDR and cloud security platforms assessing severity and scope with support from senior analysts on ambiguous cases.

• Execute established incident response playbooks for common scenarios such as phishing account compromise endpoint alerts and cloud alerts.

• Reach a clear verdict malicious benign or needs escalation and get to root cause on the alerts you own.

• Maintain accurate thorough documentation of every investigation response action and outcome.

Incident Response Support

• Support incident response on security incidents taking assigned investigative workstreams and reporting findings back to the incident lead.

• Gain exposure to a broad range of incident types including identity attacks phishing SaaS events cloud alerts and endpoint compromises.

• Collect and preserve evidence from compromised systems across Windows macOS Linux and cloud environments under the guidance of senior responders.

• Participate in on-call rotation for security alerts following documented escalation paths.

• Contribute investigation timelines and technical detail to post-incident reports.

Cloud Security

• Triage AWS security alerts such as GuardDuty findings CloudTrail anomalies and IAM events using established playbooks.

• Build working knowledge of AWS security services and partner with senior responders and engineers on cloud investigations.

Learning and Continuous Improvement

• Monitor threat intelligence for indicators of compromise relevant to Zillows environment.

• Flag false positives noisy alerts and playbook gaps to detection engineering so we can improve alert fidelity.

• Participate in tabletop exercises and team training sessions to build investigation skills.

• Contribute to the cyber defense program through documentation improvements process automation post-incident follow-through and other duties as required.

• Continuous improvement throughout Zillows security program as required

This role has been categorized as an Office position. Office employees regularly work at the Zillow India office for approximately 80 to 100 percent of their time each month. Employees must live within a reasonable commuting distance of the office. Zillow has not defined a reasonable distance and expects employees will use judgment in determining this for themselves and understand the implications re: time commitment and cost of daily commute.

In addition to a competitive base pay employees in this role are eligible for incentive compensation subject to applicable laws and relevant Zillow policies. Actual amounts will vary depending on experience performance and location.

• Education: Bachelors degree in Computer Science Cybersecurity or related field; relevant certifications (Security CySA GCIH AWS SAA) preferred.

• Experience:

  • 3 years in IT or cybersecurity with a focus on incident response and threat intelligence.

  • Strong knowledge of AWS security cloud incident response and forensic analysis tools.

  • Knowledge of multiple computing platforms such as Windows MacOS Linux and networks.

  • Proficiency in SIEM tools such as Exabeam and endpoint detection tools such as CrowdStrike.

• Skills:

  • Expertise in scripting and automation for security operations (Python PowerShell etc.).

  • Familiarity with regulatory compliance frameworks and secure coding practices.

  • Deep understanding of MITRE ATT&CK framework and common attack vectors.

  • Exceptional problem-solving and analytical abilities.

  • Strong communication skills to effectively collaborate with technical and non-technical teams.

At Zillow were reimagining how people movethrough the real estate market and through their careers. As the most-visited real estate platform in the U.S. we help people navigate buying selling financing and renting with greater ease and confidence. Whether youre working in tech sales operations or design youll be part of a company reshaping an industry and helping more people make home a reality.

Zillow is honored to be recognized among the best workplaces in the U.S. Zillow was named one of FORTUNE 100 Best Companies to Work For in 2026 and included on TIMEs Americas Best Companies 2026 list reflecting our commitment to creating an innovative inclusive and engaging culture where employees are empowered to grow.

No matter where you sit in the organization your work will help drive innovation support our customers and move the industryand your careerforward together.

Zillow Group is committed to fostering an inclusive innovative environment and to providing equal employment opportunities. We comply with applicable laws that prohibit discrimination in employment and recruitment.

If you have a disability or special need that requires accommodation during the recruitment process please contact your recruiter directly.

Qualified applicants will be considered for employment in accordance with applicable law.