Cybersecurity Analyst

This is a fully remote position, open to applicants in District of Columbia, +1 more state.

📋 Description

• Oversee and prioritize alerts related to identity, endpoint, email, network, cloud, application, vulnerability, and data-protection technologies.

• Assess, enrich, classify, prioritize, and investigate security incidents such as phishing, account breaches, malware, ransomware, unauthorized access, data exposure, insider threats, and third-party events.

• Implement approved containment measures and collaborate with Technology Operations on necessary infrastructure or production modifications.

• Gather and secure evidence; identify impacted users, devices, accounts, systems, repositories, and data.

• Assist in eradication, recovery validation, enhanced monitoring, and incident resolution.

• Collect and analyze threat intelligence from commercial, government, industry, open-source, MDR, vendor, and internal sources.

• Examine threat actors, campaigns, tactics, techniques, procedures, indicators, exploited vulnerabilities, and targeted technologies.

• Develop tactical and operational intelligence products, operationalizing findings through investigations, detections, hunting queries, watchlists, blocking actions, phishing simulations, and runbook updates.

• Conduct hypothesis-driven threat hunts utilizing MITRE ATT&CK and document scope, queries, evidence, findings, and follow-up actions.

• Validate vulnerability findings, evaluate risk and business exposure, prioritize remediation efforts, identify exploitation, and escalate critical vulnerabilities.

• Collaborate with Security Engineering on vulnerability scanning tools, integrations, configurations, and reliability.

• Manage remediation assignments, sustain vulnerability ticket flow, monitor service levels, report overdue exposures, and escalate ownership or delivery challenges.

• Create and maintain approved automation workflows, scripts, and playbooks.

• Secure evidence following established forensic, legal-hold, integrity, and chain-of-custody protocols.

• Maintain comprehensive security case documentation and verify containment and corrective actions.

• Aid in breach investigations by identifying affected repositories, records, data types, individuals, entities, and jurisdictions for Legal and Privacy review.

• Investigate token theft, MFA changes, privilege escalation, malicious application consent, mailbox manipulation, and compromised identities.

• Explore third-party, supply-chain, and AI-related security alerts or suspected misuse.

• Perform alert triage, investigations, MDR monitoring, threat intelligence analysis, threat hunting, vulnerability validation, remediation follow-up, metrics, reporting, case documentation, and authorized security-tool operations.

• Elevate architecture, complex integration, detection-platform design, routine vulnerability management, and permanent engineering requirements to Security Engineering.

• Facilitate structured handovers across operating regions and provide technical evidence to Legal and Privacy.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or a related field, or equivalent practical experience.

• Minimum of 3 years of experience in cybersecurity operations, incident response, IT operations, system administration, network security, or a related field.

• Proficient in investigating alerts using SIEM, EDR/XDR, identity, email, cloud, network, or vulnerability technologies.

• Understanding of common attacker techniques, including phishing, malware, account compromise, privilege misuse, lateral movement, exfiltration, and vulnerability exploitation.

• Proven experience in applying threat intelligence and incident telemetry to prioritize vulnerabilities and assess exploitation risks.

• Familiarity with security automation or scripting, digital evidence handling, identity investigations, third-party incident analysis, and structured case management.

• Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments.

• Knowledge of MITRE ATT&CK and common detection, threat-hunting, and incident-response methodologies.

• Understanding of vulnerability scanning and remediation workflows along with the division of responsibilities among vulnerability-program governance, threat-led escalation, and asset-owner remediation.

• Awareness of NIST CSF, ISO 27001, PCI DSS, NYDFS cybersecurity requirements, or privacy and breach-response obligations.

• Capability to support designated US business-hour coverage and engage in an escalation or on-call rotation.

• Willingness to assist with high-severity incidents outside normal working hours when necessary.

• Ability to manage confidential, legally sensitive, and security-restricted information appropriately.

• Applicants must be authorized to work for any employer in the U.S.; employment visa sponsorship is not available.

• Security+, CySA+, SC-200, GCIH, GCIA, or equivalent experience is preferred.

🏝️ Benefits

• Monthly bonuses.

• Restricted Stock Units for all new team members, vesting over 4 years.

• Comprehensive medical, dental, and vision benefits at no cost to employees.

• Four weeks of paid time off.

• Nine paid float holidays.

• Five-week sabbatical after five years of employment.

• Open, casual, pet-friendly, and enjoyable office atmosphere.

• Free medical health insurance for one dog or cat.

• Paid time off to volunteer at nonprofit organizations.

• Access to a complimentary on-site gym.

• Free dog walking services for office pets during business hours.

• Complimentary parking.

• Paid ORCA cards.