Cybersecurity Ops Analyst

This is a fully remote position, open to applicants in Tennessee.

📋 Description

• Conduct advanced security event analysis as part of the 24/7/365 Enterprise Security Operations Center Detection & Response team.

• Monitor, triage, and investigate security alerts and anomalous activities.

• Assess severity, scope, potential impact, and determine appropriate response actions.

• Analyze and correlate telemetry from network, endpoint, system, and cloud using SIEM and EDR technologies.

• Evaluate suspicious activities, threat intelligence, and vulnerability information to identify potential threats and assess organizational risk.

• Execute approved response actions, including blocking IPs, URLs, hashes, and isolating endpoints.

• Escalate confirmed or suspected incidents to the relevant incident response teams.

• Engage in proactive threat hunting to uncover suspicious behavior, indicators of compromise, and detection gaps.

• Document investigations, findings, evidence, and response actions in the incident tracking system.

• Suggest detection tuning, process improvements, and updates to procedures and documentation.

• Assist in onboarding and training new analysts through knowledge sharing, cross-training, and technical support.

• Collaborate with cybersecurity teams, including Governance, Risk, and Compliance (GRC), architecture, and detection engineering.

⛳️ Requirements

• Bachelor’s degree with 2+ years of relevant experience, or an Associate’s degree in a related field with 3+ years of experience.

• Alternatively, an additional 4+ years of experience may be considered in place of a degree.

• Must be a US Citizen.

• At least 2 years of experience in cybersecurity operations is required.

• Security+ and CySA+ certifications are mandatory.

• Hands-on experience with SIEM and EDR technologies, including the investigation of security alerts, endpoint analysis, and security event correlation.

• Experience in triaging security incidents, evaluating severity and potential impacts, and determining escalation procedures.

• Familiarity with network security fundamentals and the identification of suspicious network activity.

• Working knowledge of Windows, Linux, and cloud environments, including relevant security logs, events, and telemetry.

• Understanding of attacker tactics, techniques, and procedures, specifically the MITRE ATT&CK framework.

• Capacity to independently investigate complex or unfamiliar security events and apply sound technical judgment.

• Excellent written and verbal communication skills, including the ability to document clearly and coordinate with both technical and non-technical stakeholders.

• Ability to share technical knowledge and mentor less experienced analysts.

• Preferred: hands-on experience with Splunk Enterprise Security.

• Preferred: experience with the full incident response lifecycle, including containment, eradication, recovery, and post-incident analysis.

• Preferred: experience in proactive threat hunting and detection tuning.

• Preferred: familiarity with Python, PowerShell, or similar scripting and automation technologies.

🏝️ Benefits

• Remote work opportunity available throughout the United States.

• Options for 2nd shift or 3rd shift schedules.

• Equal Opportunity Employer.