Cybersecurity Ops Analyst

Job Description:

• Perform advanced security event analysis as part of the 24/7/365 Enterprise Security Operations Center Detection & Response team
• Monitor, triage, and investigate security alerts and anomalous activity
• Determine severity, scope, potential impact, and appropriate response actions
• Analyze and correlate network, endpoint, system, and cloud telemetry using SIEM and EDR technologies
• Evaluate suspicious activity, threat intelligence, and vulnerability information to identify potential threats and assess organizational risk
• Execute approved response actions, including IP, URL, and hash blocks and endpoint isolation
• Escalate confirmed or suspected incidents to appropriate incident response teams
• Participate in proactive threat hunting to identify suspicious behavior, indicators of compromise, and detection gaps
• Document investigations, findings, evidence, and response actions in the incident tracking system
• Recommend detection tuning, process enhancements, and procedure and documentation updates
• Support onboarding and training of new analysts through knowledge sharing, cross-training, and technical assistance
• Collaborate with cybersecurity teams including GRC, architecture, and detection engineering

Requirements:

• Bachelor’s degree and 2+ years of experience, or an Associate’s degree in a related discipline and 3+ years of experience
• An additional 4+ years of experience may be considered in lieu of a degree
• Must be a US Citizen
• Minimum 2 years of cybersecurity operations related experience
• Security+ and CySA+ certifications required
• Hands-on experience with SIEM and EDR technologies, including security alert investigation, endpoint analysis, and correlation of security events
• Experience triaging security incidents, assessing severity and potential impact, and determining escalation procedures
• Working knowledge of network security fundamentals and identification of suspicious network activity
• Working knowledge of Windows, Linux, and cloud environments, including relevant security logs, events, and telemetry
• Understanding of attacker tactics, techniques, and procedures, including the MITRE ATT&CK framework
• Ability to independently investigate complex or unfamiliar security events and exercise sound technical judgment
• Strong written and verbal communication skills, including clear documentation and coordination with technical and nontechnical stakeholders
• Ability to share technical knowledge and guide less experienced analysts
• Preferred: hands-on experience with Splunk Enterprise Security
• Preferred: experience with full incident response lifecycles, including containment, eradication, recovery, and post-incident analysis
• Preferred: proactive threat hunting and detection tuning experience
• Preferred: familiarity with Python, PowerShell, or similar scripting and automation technologies

Benefits:

• Remote work anywhere in the United States
• 2nd shift or 3rd shift schedule option
• Equal Opportunity Employer