{"id":3186559,"url":"https://alion.io/job/aprio-senior-security-analyst-raas-managed-services","title":"Senior Security Analyst, RAAS | Managed Services","company":{"id":4900,"name":"Aprio","domain":"aprio.com","url":"https://alion.io/company/aprio","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":79,"open_postings":58,"ghost_share":0.017,"stale_share":0.776,"repost_share":0.034,"time_to_fill_p50_days":52,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Atlanta, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":94000,"max":153000,"currency":"USD","period":"year","gross":null,"usd_annual":153000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Windows","optional":false},{"name":"Azure","optional":true},{"name":"Copilot","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"closed","first_seen_at":"2026-10-23T21:47:00Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-27T13:27:26Z","board_verified":false,"closed_at":"2026-10-27T13:27:26Z","days_open":3,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":3},"description":"Job Summary\nAprio is seeking a Senior Security Analyst to monitor, triage, and respond to threats across our managed security clients using the Microsoft security stack. You will serve as the first line of defense for dozens of client environments, working primarily in Microsoft Sentinel and Microsoft Defender XDR to detect, investigate, and contain threats before they cause harm. This role will carry a share of after-hours and on-call coverage to ensure clients are protected around the clock. Our Sentinel SOAR platform automates enrichment and first-response containment, allowing you to focus on investigation and judgment - not copy-paste triage.\nYou will deliver clear, client-ready incident communication and contribute to the continuous improvement of detection and automation capabilities across a growing managed security practice.\nWhat You'll Gain / Impact:\nOpportunity to protect dozens of client environments across a variety of industries using enterprise-grade Microsoft security tools.\nHands-on experience with Microsoft Sentinel SOAR automation, including Logic Apps playbooks and multi-tenant management.\nExposure to a structured, process-driven SOC with defined escalation paths, client runbooks, and direct client engagement.\nAbility to contribute directly to detection engineering, automation development, and continuous improvement of managed security services.\nCareer growth within a high-performing managed security team at a nationally recognized professional services firm.\nKey Responsibilities:\nMonitoring and Triage\nMonitor alerts and incidents across client tenants in Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps.\nTriage incidents enriched by automated playbooks, verify enrichment accuracy, and meet SLAs for acknowledgment. (MTTA) and containment (MTTC); differentiate true positives from false positives and benign activity.\nInvestigate suspicious sign-ins, risky users, and conditional access failures in Microsoft Entra ID.\nInvestigation and Response\nWrite and tune KQL queries for threat hunting, investigation, and detection rule development.\nTrigger, approve, or reverse automated and on-demand containment playbooks in alignment with each client's authorized-actions matrix.\nOperate and author Sentinel automation rules and Logic Apps playbooks.\nEscalate confirmed incidents to senior analysts or incident response teams with a complete timeline and supporting evidence.\nReview and approve or reject automated containment actions requiring human decision prior to execution - including isolating a device, disabling an account, or quarantining email for VIPs or critical assets.\nValidate automated outcomes and reverse actions when incorrect, including releasing a device, re-enabling a user, or restoring email.\nMonitor playbook health including Logic App run history, failed runs, throttling, and expired connector or API connections.\nMaintain per-client automation settings including watchlists (VIPs, break-glass accounts, approved admin IPs, exempt hosts), automation rule order and conditions, and severity-based notification routing.\nEnsure client notifications accurately reflect automated actions, including which action was taken, when, and which playbook executed.\nIdentify and report opportunities for new automation and tuning based on repeated manual steps, false-positive patterns, or noisy rules.\nFollow change control procedures for automation; all changes to production playbooks are submitted through Sentinel Repositories/CI-CD - no direct edits to production environments.\nClient Communication\nNotify clients of incidents via phone, email, or ticketing system according to severity level and each client's runbook.\nWrite clear incident summaries and remediation recommendations tailored to both technical and non-technical audiences.\nContribute to monthly client security reports and service reviews.\nContinuous Improvement\nTune analytics rules to reduce alert noise across multi-tenant environments.\nUpdate runbooks, knowledge base articles, and shift handover notes.\nTrack emerging threats and Microsoft security updates and share relevant findings with the team.\nSchedule and After-Hours Coverage\nParticipate in rotating after-hours, evening, weekend, and holiday on-call coverage to ensure 24/7 client protection.\nFollow each client's escalation matrix, including after-hours phone contacts for critical incidents.\nMaintain a reliable home internet connection and phone for remote shifts and on-call coverage.\nCandidate Qualifications:\n3-4 years of experience in a SOC, MSSP, MDR, or IT security operations role.\nHands-on production experience with Microsoft Sentinel and Microsoft Defender XDR.\nWorking knowledge of KQL.\nSolid understanding of Microsoft Entra ID, Microsoft 365, Windows endpoints, networking fundamentals, and common attack techniques (MITRE ATT&CK).\nClear written and verbal communication skills, including composure and clarity during active client incidents.\nAvailability and willingness to work evenings, weekends, holidays, and on-call rotations.\nAbility to work independently with minimal supervision.\nWorking knowledge of Sentinel automation rules, incident tasks, and playbook triggers (incident, alert, and entity triggers).\nSound judgment regarding when automation should be trusted and when it should be overridden.\nMicrosoft SC-200 certification required, plus at least one of the following (or committed to earning within 90 days of hire): SC-300, AZ-500, AZ-104, or SC-401.\nPreferred Qualifications:\nExperience managing multiple tenants simultaneously through Azure Lighthouse or Defender XDR multi-tenant management.\nExperience building Sentinel automation with Logic Apps, along with PowerShell or Python scripting.\nFamiliarity with Microsoft Security Copilot, Defender for Cloud, and Microsoft Purview.\nSC-401 (Information Security Administrator) or SC-100 (Cybersecurity Architect Expert).\nVendor-neutral certifications such as CISSP.\nBachelor's degree in cybersecurity, IT, or a related field, or equivalent experience.","description_format":"text","description_chars":6112,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Wealth Management & Financial Advisors","Audit & Assurance Firms","Accounting & Bookkeeping Services","Tax Advisory & Preparation"],"lifecycle":[{"event":"open","at":"2026-10-24T00:02:14Z"},{"event":"close","at":"2026-10-27T13:27:26Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"green card filings: 1","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":1,"median_offered_wage_usd":112500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":null,"pay":{"stated_usd_annual":153000,"is_top_pay":false},"html_url":"https://alion.io/job/aprio-senior-security-analyst-raas-managed-services","json_url":"https://alion.io/job/aprio-senior-security-analyst-raas-managed-services.json","meta":{"generated_at":"2026-10-29T03:13:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4869,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4900},"rest":"https://alion.io/mcp/rest/get_company?id=4900"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faprio-senior-security-analyst-raas-managed-services"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faprio-senior-security-analyst-raas-managed-services"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faprio-senior-security-analyst-raas-managed-services"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/aprio-senior-security-analyst-raas-managed-services\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faprio-senior-security-analyst-raas-managed-services"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3186559}},{"tool":"search_jobs","arguments":{"company":"aprio.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3186559},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}