IT Security Analyst

The IT Security Analyst is responsible for the management, detection, and analysis that enables incident response and security operations. This role involves developing and maintaining threat monitoring capabilities used by the security team. Additionally, the role includes performing penetration testing activities to identify vulnerabilities within the organization's systems and networks. The position requires experience analyzing malware and other related cyber threats while implementing and maintaining security and analysis solutions for a large organization, with knowledge of large-scale threat analysis of event data from commercial and open-source infrastructure technology platforms.

Additionally, the role involves leveraging foundational networking knowledge to assist in threat hunting and network traffic analysis, fostering a hybrid skill set bridging security and networking. Candidates with an interest in both cybersecurity and networking will find this position an excellent opportunity to enhance their skills and gain practical experience across both domains.

This is meant to be a general description of the most essential functions of this role.  Other duties may be assigned.   

1. Conducts detailed security event analysis from network traffic attributes and host-based attributes to identify information security incidents.
2. The Analyst must be competent to work at a technical level, be capable of identifying threats and vectors that cause security events and be able to follow defined procedures for mitigating said threats.
3. Participates in detecting, investigating, and resolving security events.
4. Performs all procedures necessary to ensure the safety of information systems assets and to protect systems from intentional or inadvertent access or destruction.
5. Responds to alerts coming through SIEM or various security tools. Monitors, analyzes, and investigates security alerts and escalates incidents if necessary.
6. Participates in continuous quality improvement, making recommendations for the development of Information Technology processes and procedures.
7. Assist with basic network troubleshooting and configuration to support secure network operations and improve incident investigation.
8. Supports firewall rule analysis and reviews to identify potential misconfigurations and vulnerabilities.
9. Work with team to monitor and secure cloud-based network environments, ensuring compliance with security standards.
10. Conduct audits of network configurations and firewall rules to identify potential vulnerabilities and misconfigurations.

1. As an IT Security Operations Analyst, you should be able to analyze log output from Azure Sentinel, Cisco Meraki and Azure AD.
2. Demonstrated incident handling ability required.
3. Familiarity with investigating security issues by reviewing logs and correlating data from different sources. Basic knowledge of windows administration.
4. Comfortable working with tools that collect and manage system event data, like SIEM platforms or log management systems.
5. A solid understanding of networking, operating systems, and enterprise integrations required.
6. Foundational knowledge of subnetting, VLANS, and network protocols to support threat detection and response efforts.
7. Hands-on experience with basic network configuration, including routers, switches and firewall rules, is a plus.
8. Understanding of Zero Trust principles and how they apply to network architecture and security policies.
9. Basic understanding of packet capture analysis and traffic flow to assist in network threat investigation.
10. Self-directed and able to perform tasks without supervision.
11. A thorough understanding of TCP/IP required.
12. Understand IDS / IPS rules to identify and/or prevent malicious activity.

Education/ Licensure/ Certification Requirements and Qualifications

1. Bachelor’s degree in Computer Science, Information Systems, Engineering or 2-3 years of related work experience required.
2. Minimum of 1-2 years of experience in an IT environment required.
3. Networking certifications such as Network+, CCNA, CompTIA Security+ with a networking focus are highly desirable but not required.
4. Experience investigating security events, threats and/or vulnerabilities required.
5. Ability to pass DHS background study.