Security Analyst

This is a fully remote position, open to applicants in New York.

📋 Description

• Define, validate, and report on security controls to safeguard company assets and sensitive information while mitigating cyber risk.

• Enhance identity security utilizing Microsoft Entra ID, Conditional Access, phishing-resistant MFA, and Privileged Identity Management (PIM).

• Integrate, deploy, support, and continuously refine security tools along with the Microsoft security stack, encompassing Defender XDR, Microsoft Sentinel and KQL, and Microsoft Intune security features.

• Oversee the managed detection and response (MDR) provider, including escalations, tuning, and service evaluations.

• Lead the vulnerability and exposure management program, setting remediation SLAs, verifying remediation evidence, and reporting on status, exceptions, and risk trends.

• Direct incident response and act as the primary security contact during incidents; maintain playbooks, escalation procedures, tabletop exercises, and on-call expectations.

• Establish Azure cloud security guardrails for landing zones and supervise Defender for Cloud, Azure Policy, and associated cloud security controls.

• Manage data protection controls through Microsoft Purview sensitivity labeling and data loss prevention for customer data and personally identifiable information.

• Enforce the AI Usage Policy and manage risks related to Microsoft Copilot oversharing, shadow AI, and SaaS discovery.

• Oversee third-party and vendor security risk, including due diligence, ongoing reviews, evidence collection, and customer security questionnaires.

• Handle security ticket workflows for access reviews and phishing reports; define response SLAs and verify supporting evidence.

• Create and maintain security documentation, including policies, risk registers, incident response records, and audit evidence.

• Align the security program with NIST Cybersecurity Framework (CSF) 2.0, CIS Controls, SOC 2 Type II, USPS licensing security requirements, and cyber insurance attestations.

• Validate ransomware resilience through evidence of immutable backups and regular recovery testing.

• Manage the security awareness training program and collaborate across teams to reinforce security policies, controls, monitoring, and best practices.

• Provide backup support for network, server, and cloud administration as needed, without taking on primary responsibility for routine administration.

• Assist with security-related budgets and procurement.

• Act as a liaison with security and IT professionals at BlueCrest and Platinum.

• Develop and manage security reports and dashboards for management.

• Serve as the escalation contact for critical security incidents, including those flagged by the MDR provider.

• Participate in on-call rotation and perform occasional evening and weekend work for maintenance, testing, and incident response.

⛳️ Requirements

• 5+ years of experience in cybersecurity operations or an equivalent field.

• Strong comprehension of secure network architecture and networking principles.

• Familiarity with Windows, macOS, and Linux operating systems.

• Practical security experience with Microsoft 365 and Microsoft Azure, including Entra ID, Conditional Access, phishing-resistant MFA, PIM, Defender XDR, Microsoft Sentinel, Microsoft Intune security features, Defender for Cloud, and Azure Policy.

• Capability to assess the security configuration and risk posture of network infrastructure, including Juniper and Cisco switches and Fortinet firewalls.

• Experience in supporting SOC 2 Type II audits, including control validation and evidence collection.

• Knowledge of NIST Cybersecurity Framework (CSF) 2.0 and CIS Controls.

• Proficiency in PowerShell scripting and KQL query skills for security operations, investigation, and automation.

• Ability to respond swiftly to critical issues and willingness to engage in on-call rotation.

• Strong written and verbal communication abilities, including the capacity to define security SLAs, evaluate evidence, report risks, and communicate requirements to both technical and business stakeholders.

• Understanding of adversary tactics and tools (MITRE ATT&CK; e.g., Cobalt Strike and Mimikatz) sufficient to detect, hunt, and validate controls.

• One or more relevant security certifications are preferred, such as Microsoft Certified: Security Operations Analyst Associate (SC-200), Azure Security Engineer Associate (AZ-500), Identity and Access Administrator Associate (SC-300), or CISSP.

• Must be eligible to work within the United States.

🏝️ Benefits

• Employees have the option to work remotely.

• Occasional travel to data center facilities, client locations, or BCC Software headquarters may be required.

• Time zone flexibility is available for employees located in different areas of the U.S.

• Participation in an on-call rotation with defined after-hours response expectations.

• Periodic evening and weekend work for planned maintenance, security testing, and incident response.

• Commitment to equal employment opportunity and reasonable accommodations for qualified individuals with disabilities.