Senior Security Analyst

Performance Contracting Group is a national employee-owned specialty contractor that offers quality services and products to the commercial, industrial, and non-residential construction markets. We are committed to recruiting, developing, and advancing employees from a diversity of backgrounds and experiences, as well as supporting a culture of safety and inclusiveness that allows you to contribute to your fullest potential. We place high value on training and professional development, encouraging you to broaden and strengthen your unique skill sets so you can fully realize your potential.

The Senior Security Analyst is a senior individual contributor responsible for security monitoring, threat analysis, incident response, vulnerability and exposure management, security assessments, and continuous improvement of operational security practices. The role provides advanced analytical support for complex security events, evaluates technical risk, recommends practical controls, and helps improve the organization’s overall security posture.

In addition to broad Senior Security Analyst responsibilities, this position serves as a security subject matter resource for artificial intelligence, automation, citizen-developed applications, and other emerging technologies. AI security is an area of emphasis within the role, not its exclusive function. The position partners closely with Security Operations, Security Engineering, GRC, Data Governance, Privacy, Legal, IT Operations, application owners, platform teams, and business stakeholders.

• Perform advanced security monitoring and analysis across SIEM, endpoint, email, identity, network, cloud, application, and other security data sources.
• Triage and investigate alerts, correlate activity across multiple platforms, determine business impact, and recommend appropriate response actions.
• Conduct proactive threat hunting, review relevant threat intelligence, and identify emerging threats that may affect the organization.
• Improve detection use cases, alert logic, triage guidance, escalation criteria, and analyst investigation procedures.
• Provide senior-level analytical support for complex security events and mentor analysts through technical review and knowledge sharing.

• Identify, investigate, contain, and support recovery from cybersecurity incidents in coordination with Security Operations and business partners.
• Analyze suspected unauthorized access, malware, phishing, account compromise, data exposure, policy violations, and other security events.
• Collect and preserve relevant evidence, document investigative findings, assess impact, and communicate recommended actions clearly.
• Maintain and improve incident response procedures, investigation playbooks, escalation paths, and lessons-learned activities.
• Participate in tabletop exercises and readiness activities that strengthen organizational response capabilities.

• Analyze vulnerabilities and security exposures, validate findings, assess applicability and risk, and coordinate remediation with system owners.
• Review technical designs, configurations, authentication and authorization models, network paths, APIs, secrets management, logging, and security controls.
• Perform or coordinate security assessments, threat modeling, control validation, abuse-case analysis, and technical risk reviews.
• Track findings through remediation, verification, exception, or formal risk acceptance using established processes.
• Evaluate new security products and technologies and recommend improvements to security controls, tooling, and operational practices.

• Assess AI platforms, generative AI tools, agents, copilots, machine learning solutions, automation, low-code applications, and citizen-developed technology as part of the broader security review function.
• Evaluate risks involving prompts, model outputs, knowledge sources, connectors, retrieval methods, data flows, third-party processing, retention, identity, and access.
• Analyze AI-specific threats such as prompt injection, data leakage, insecure output handling, excessive agency, unsafe tool use, unauthorized retrieval, and supply-chain compromise.
• Provide practical security guidance and reusable control patterns for proof-of-concept, pilot, and production use of AI-enabled solutions.
• Monitor relevant AI…