Security Analyst II

Perform advanced security triage and investigations across endpoint server network and cloud environments.

Conduct proactive threat hunting to identify investigate and isolate suspicious or malicious activity within client environments.

Lead deep-dive investigations into security incidents identifying root causes indicators of compromise (IOCs) and potential business impact.

Analyze security alerts logs and telemetry using SIEM EDR and other security monitoring platforms.

Utilize the MITRE ATT&CK framework to map adversary tactics and techniques assess detection coverage and identify gaps in client security posture.

Coordinate incident investigations and escalations providing technical analysis and remediation recommendations.

Review network traffic endpoint artifacts and system logs to identify indicators of attack and compromise.

Develop maintain and improve security documentation investigation procedures and incident response runbooks.

Participate in an after-hours on-call rotation serving as an Incident Controller when required.

Scope and assess client security incidents ensuring timely investigation communication and escalation.

3 years of progressive experience in cybersecurity security operations incident response or a related IT security role.

Strong experience conducting security investigations incident triage threat hunting and advanced security analysis.

Hands-on experience with Endpoint Detection and Response (EDR) platforms such as CrowdStrike Falcon SentinelOne or Microsoft Defender for Endpoint.

Advanced knowledge of at least one leading SIEM platform including Microsoft Sentinel Splunk Elastic Security IBM QRadar or Google Chronicle.

Strong understanding of the MITRE ATT&CK framework including mapping security detections to adversary tactics and techniques.

Experience analyzing security events identifying indicators of compromise and investigating malicious activity across enterprise environments.

Previous experience working within a Managed Detection & Response (MDR) provider Managed Security Services Provider (MSSP) or enterprise Security Operations Center (SOC).

Experience with Security Orchestration Automation and Response (SOAR) platforms and security workflow automation.

Familiarity with cloud security monitoring and incident investigations across Microsoft Azure AWS or Google Cloud.

Experience developing or tuning SIEM detection rules security use cases and threat hunting queries.

Experience supporting client-facing incident investigations and communicating technical findings to security stakeholders.

Knowledge of vulnerability management threat intelligence and proactive security monitoring techniques.