Cybersecurity Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee, assess, investigate, document, and coordinate responses to security alerts, incidents, tickets, and suspicious activities across Microsoft and third-party security platforms.

• Collaborate with BRG’s managed security provider to investigate alerts, validate activities, track remediation efforts, and enhance alert quality and operational workflows.

• Manage and support Microsoft security features across Azure, Microsoft Entra ID, Active Directory, Microsoft Defender, Defender for Cloud, Sentinel, and Microsoft Purview within the approved role and change-control parameters.

• Analyze Azure security recommendations, policies, and configuration findings; assist in testing, documenting, and implementing Azure Policy initiatives, security baselines, and control exceptions.

• Facilitate identity security operations, including Conditional Access, privileged access and PIM reviews, role lifecycle management, stale-account cleanup, authentication controls, service accounts, guest access, and privileged-group monitoring.

• Assist with Proofpoint email security, phishing-reporting workflows, Threat Response capabilities, account-takeover protections, security-awareness integrations, and email-policy optimization.

• Utilize Tenable Cloud Security and related vulnerability management tools to assess cloud exposure, attack paths, asset coverage, security findings, and remediation status.

• Support Netskope cloud application and traffic-steering policies, which include application discovery, policy testing, AI application controls, exception handling, and validation of user impact.

• Evaluate security risks related to generative AI and other AI-enabled services; assist in managing AI application inventory, monitoring usage, controlling access, testing policies, and conducting governance reviews.

• Examine email, identity, endpoint, cloud, and application activities using available logs and evidence; escalate confirmed or potentially significant events through the incident-response process.

• Monitor vulnerabilities and security recommendations, identify technical owners, validate remediation evidence, document accepted risks or exceptions, and report status to stakeholders.

• Develop and maintain operating procedures, configuration records, support documentation, security metrics, dashboards, and audit/control-review evidence.

• Engage in change reviews and verify that cybersecurity-managed changes encompass testing, implementation, rollback, communication, and post-change documentation.

• Assess security tools and features, conduct structured testing, document findings, and suggest enhancements to security controls and operations.

• Participate in risk assessments, tabletop exercises, incident-response activities, cross-training, and an on-call or escalation rotation as needed.

• Collaborate with IT Leadership, technical teams, Infrastructure, Network, Service Desk, Risk and Compliance, and external security partners to align technologies, investigate issues, apply controls, and coordinate remediation efforts.

⛳️ Requirements

• A minimum of 3 years of experience in cybersecurity operations, cloud security, identity security, security engineering, or a closely related field.

• Proficient knowledge of Microsoft Azure security, Microsoft Entra ID, Active Directory, Azure Policy, Conditional Access, PIM, Defender, Defender for Cloud, Sentinel, and Purview.

• Experience interpreting and implementing security baselines, such as Microsoft security baselines and CIS Benchmarks, including testing, exception documentation, and tracking remediation.

• Practical familiarity with email security and phishing-response workflows; experience with Proofpoint is highly preferred.

• Experience with cloud security posture management or CNAPP capabilities; familiarity with Tenable Cloud Security is preferred.

• Knowledge of secure web gateway, cloud access security broker, or SaaS application-control platforms; experience with Netskope policy and traffic-steering is preferred.

• General understanding of AI security risks, including sensitive-data exposure, unapproved AI services, prompt and response monitoring limitations, application categorization, access control, and governance.

• Comprehension of common identity and authentication concepts, including MFA, passwordless authentication, OAuth, SAML, Kerberos, privileged access, and least privilege principles.

• Ability to analyze alerts and logs, differentiate expected administrative actions from suspicious activities, develop a defensible timeline, and document conclusions and follow-up actions clearly.

• Experience working with a SOC, MDR provider, or other outsourced monitoring partners.

• Familiarity with Windows, macOS, cloud platforms, enterprise SaaS, and hybrid identity environments.

• Knowledge of common security and compliance frameworks, such as NIST CSF, CIS Controls, SOC 2, ISO 27001/27002, HIPAA, or HITRUST.

• Relevant security certifications, such as Microsoft Certified: Security Operations Analyst Associate (SC-200), CompTIA Security+, CompTIA CySA+, GIAC certifications, or equivalent credentials, are preferred.

• The candidate must be able to provide verification of their legal right to work in the U.S. without company sponsorship.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance.

• Generous paid time off and holiday schedule.

• Opportunities for professional development and certification reimbursement.

• Flexible work arrangements and a supportive work environment.