Security & Network Analyst II

This is a fully remote position, open to applicants in Connecticut, +3 more states.

📋 Description

• Provide support for security and network operations with an emphasis on threat detection, cyber defense, incident response, and the security and availability of enterprise systems.

• Monitor, investigate, and address alerts from SIEM, EDR/XDR, IDS/IPS, firewalls, vulnerability management, identity management, cloud security, and network monitoring platforms.

• Analyze logs, endpoint telemetry, authentication records, firewall events, DNS activity, proxy logs, packet captures, and network flow data.

• Investigate and manage reports of suspicious activity, security alerts, vulnerability findings, VPN issues, access requests, connectivity problems, and service interruptions.

• Conduct incident response activities, which include event analysis, scoping, evidence collection, documentation, containment support, escalation, and follow-up after incidents.

• Troubleshoot issues related to DNS, DHCP, routing, switching, firewall policies, VPN connectivity, wireless networks, identity services, endpoints, and application access.

• Assess false positives, benign activities, policy violations, operational challenges, and security incidents that require escalation or response.

• Escalate complex technical problems to Security Engineering, Network Engineering, Infrastructure, or application support teams, accompanied by documentation and impact assessments.

• Identify recurring issues, monitoring gaps, alert quality concerns, and opportunities for process improvement.

• Aid in vulnerability management by validating findings, assessing exposure, prioritizing remediation efforts, and tracking the resolution process.

• Assist in firewall rule reviews, VPN troubleshooting, network segmentation validation, access control issues, implementation testing, and post-change monitoring.

• Collaborate with engineering, infrastructure, and application teams to enhance monitoring, detection capabilities, procedures, and incident response.

• Create and maintain investigation notes, knowledge base articles, troubleshooting guides, operational procedures, and incident documentation.

• Provide mentorship and knowledge sharing to less experienced analysts and contribute to team training initiatives.

• Participate in security projects, technology implementations, and continuous improvement activities.

⛳️ Requirements

• A Bachelor's degree is required; a Master's degree is preferred. A combination of education and experience may be accepted in place of a degree.

• A minimum of three years of experience in technology, cybersecurity operations, network operations, infrastructure support, incident response, or a similar technical role.

• Intermediate knowledge in areas related to SOC, NOC, security operations, network operations, managed security, enterprise infrastructure, or hybrid security/network operations environments is preferred.

• Proven ability to work independently on complex tickets, alerts, incidents, and troubleshooting tasks with minimal supervision.

• Intermediate understanding of TCP/IP, DNS, DHCP, routing, switching, VPNs, firewalls, proxy services, wireless networking, endpoint security, identity and access management, and common enterprise security controls.

• Intermediate experience with various tools for security, network, vulnerability management, monitoring, log analysis, ITSM/ticketing, cloud security, or infrastructure monitoring is preferred.

• Experience in analyzing endpoint, identity, network, cloud, and application telemetry to detect anomalous behavior, unauthorized access, malware activity, phishing attempts, credential abuse, lateral movement, vulnerability exploitation, or service degradation.

• Ability to conduct structured troubleshooting and root-cause analysis across security, network, endpoint, identity, and application layers.

• Experience in supporting incident response activities, including alert validation, event correlation, impact assessment, containment coordination, evidence collection, timeline development, and post-incident documentation.

• Experience with reviewing or assisting in firewall policies, VPN access, network segmentation, remote access technologies, and secure connectivity workflows is preferred.

• Familiarity with frameworks such as NIST NICE, NIST Cybersecurity Framework, NIST SP 800-53, CIS Controls, MITRE ATT&CK, or similar is preferred.

• Experience in managing hybrid cloud or SaaS environments like AWS, Azure, Google Cloud, Microsoft 365, Okta, or Entra ID is preferred.

• Proficiency in scripting, automation, or query languages such as PowerShell, Python, Bash, KQL, SPL, SQL, SOAR playbooks, or API-based workflows is preferred.

• Relevant security, network, or cyber defense certifications such as Security+, Network+, CySA+, SSCP, GSEC, CCNA, or equivalent experience are preferred.

• Ability to handle competing priorities in a high-volume ticket and alert environment.

• Strong skills in communication, organization, troubleshooting, documentation, and collaboration.

• A commitment to continuous education.

🏝️ Benefits

• Comprehensive health and wellness plans.

• Opportunities for professional development and training.

• Flexible work arrangements.

• Retirement savings options with company matching.

• Generous paid time off and holiday policies.