Security Operations Analyst

The analyst applies structured analytical techniques to assess risk, identify emerging threats, and provide actionable recommendations to Information Technology and business leadership. The role also contributes to broader Information Security initiatives, including security architecture reviews, standards development, security automation, and operational maturity improvements. 

Key Responsibilities 

Security Monitoring and Incident Response 

• Monitor security events and alerts across enterprise technologies to identify malicious activity, security incidents, and control failures. 

• Investigate cybersecurity events and incidents, including malware infections, account compromise, insider threats, phishing attacks, unauthorized access attempts, and data security concerns. 

• Coordinate and facilitate incident response activities across technical and business teams. 

• Execute containment, eradication, and recovery activities during security incidents. 

• Perform root cause analysis and document lessons learned following incident resolution. 

• Maintain incident documentation, evidence collection, and reporting in accordance with organizational standards. 

Threat Detection and Threat Management 

• Monitor for attempts to circumvent security controls by internal users, third parties, and external threat actors. 

• Conduct threat hunting activities using available telemetry, logs, and threat intelligence. 

• Manage and improve security detection capabilities within SIEM, EDR, and related security technologies. 

• Analyze threat intelligence and translate findings into actionable security improvements. 

• Maintain blacklist, watchlist, and detection management processes. 

Vulnerability Management 

• Execute and continuously improve vulnerability management processes across infrastructure, applications, cloud environments, and emerging technologies. 

• Coordinate vulnerability assessments, penetration testing, secure code reviews, red team exercises, and remediation efforts. 

• Evaluate vulnerabilities for business risk and prioritize remediation activities. 

• Track remediation progress and communicate risk exposure to leadership and stakeholders. 

Security Operations and Continuous Improvement 

• Analyze, evaluate, and test the effectiveness of existing security controls. 

• Assess security processes and identify opportunities for operational improvement and increased efficiency. 

• Apply structured analytical methodologies to incident investigations, threat analysis, and process optimization efforts. 

• Develop operational metrics, reporting, and dashboards to support risk-informed decision-making. 

• Support audit, compliance, and regulatory initiatives as required. 

Security Strategy and Collaboration 

• Communicate security risks, control effectiveness, and incident trends to Information Technology leadership and business stakeholders. 

• Support security architecture reviews, technology evaluations, and project security assessments. 

• Contribute to the development and maintenance of security standards, policies, procedures, and playbooks. 

• Partner with infrastructure, cloud, application development, and business teams to strengthen the organization’s overall security posture. 

Required Qualifications 

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, or an equivalent combination of education and experience. 

• Five or more years of experience in cybersecurity, security operations, incident response, or threat management. 

• Experience coordinating multidisciplinary teams during cybersecurity incidents. 

• Strong understanding of security principles across operating systems, applications, networking, cloud platforms, mobile technologies, endpoint security, and identity and access management. 

• Experience with SIEM, EDR/XDR, vulnerability management, and security monitoring technologies. 

• Strong analytical, communication, and problem-solving skills. 

• Ability to perform effectively under pressure and manage multiple priorities simultaneously. 

Preferred Qualifications 

• Industry certifications such as CISSP, GCIH, GCFA, CISA, CEH, OSCP, or Security+. 

• Master’s degree in Cybersecurity, Information Security, Computer Science, or related discipline. 

• Experience managing or responding to significant cybersecurity incidents and enterprise-scale investigations. 

• Experience with business intelligence, reporting, and data analytics tools. 

• Experience with Python, PowerShell, or other automation and orchestration technologies. 

• Experience designing or supporting Security Orchestration, Automation, and Response (SOAR) solutions. 

• Knowledge of threat intelligence, digital forensics, cloud-native security, and modern detection engineering practices. 

• Experience applying artificial intelligence, machine learning, or neural network technologies to cybersecurity operations.