Cybersecurity Analyst (Fraud Ops Support)

About the role

FNF ® is the leading provider of title insurance and settlement services to the real estate and mortgage industries. FNF ®'s various mortgage and real estate services companies provide services that complement our title insurance business.

From a full-service qualified intermediary, home warranties, UCC insurance, relocation services, and notary services, we provide essential services to fulfill the needs of a changing real estate industry. FNF ® believes the power of technology can elevate the real estate transaction.

From investments in title and escrow software to industry-leading real estate partner solutions, we take our commitment to provide real estate professionals and consumers with a truly reimagined, transparent, connected, and trusted real estate experience to heart.

Position Overview

The Cybersecurity Analyst will primarily focus on cybersecurity monitoring, threat detection, incident response, and cyber investigations. As a secondary responsibility, this position will support enterprise fraud operations by conducting fraud investigations, identifying fraud trends, supporting financial crime prevention efforts, and collaborating with internal business units and external partners.

The ideal candidate combines strong technical cybersecurity capabilities with analytical thinking, investigative skills, and an interest in combating both cybercrime and fraud targeting a Fortune 500 enterprise.

Location

• Hybrid schedule working 3 - 4 days per week onsite at the National Cyber-Forensics and Training Alliance (NCFTA) facility in Pittsburgh, PA.

Duties & Responsibilities

Cybersecurity Operations (Approximately 75%)

• Monitor enterprise security tools, alerts, and threat intelligence feeds.
• Investigate suspicious activity across networks, endpoints, cloud environments, and business applications.
• Analyze security incidents and conduct triage, containment, eradication, and recovery activities.
• Identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs).
• Perform threat hunting and proactive investigations.
• Support digital forensics and incident response activities.
• Review logs from SIEM, EDR, cloud security, and identity management platforms.
• Collaborate with threat intelligence partners and industry information-sharing organizations.

Fraud Operations Support (Approximately 25%)

• Assist with investigations involving wire fraud, business email compromise, identity fraud, title fraud, account takeover, and other financial crimes.
• Analyze fraud cases and identify emerging trends and attack patterns.
• Support fraud prevention controls and fraud detection initiatives.
• Partner with legal, compliance, risk management, and business operations teams.
• Gather and preserve evidence supporting investigations.
• Produce fraud intelligence reports and recommendations.
• Coordinate with law enforcement and industry partners when appropriate.

Minimum Requirements

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Systems, or a related field.
• Requires 3-7+ years of experience in cybersecurity operations, incident response, threat hunting, cyber investigations, or security analysis.
• Experience using one or more SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, or Palo Alto XSIAM.
• Knowledge of common attack frameworks including MITRE ATT&CK.
• Understanding of network security, endpoint security, cloud security, and identity management.
• Experience analyzing security logs and conducting investigations.
• Strong verbal and written communication skills.
• Ability to obtain and maintain access to the NCFTA facility.

Preferred Experience

• Experience supporting fraud investigations or financial crime programs.
• Knowledge of wire fraud, payment fraud, real estate transaction fraud, business email compromise, or account takeover schemes.
• Familiarity with digital forensics methodologies.
• Experience with threat intelligence platforms.
• Knowledge of Microsoft 365, Azure, AWS, and cloud security controls.
• Experience working with law enforcement, intelligence-sharing organizations, or industry consortiums.
• One or more of the following certifications: CISSP, GIAC GCIH, GCFA, GCIA, Security+, CySA+, CFE (Certified Fraud Examiner), CISA

Compensation & Benefits

FNF, its affiliates, and subsidiaries carefully considers multiple factors to determine compensation, including a candidate's education, training, specialty, experience, and work location. The base salary (exempt) or hourly rate (non-exempt) is just one component of the total rewards package offered to our employees, including potential bonus or commission eligibility, insurance (medical/dental/vision/life/disability), matching 401(k) plan and matching employee stock purchase plan.