Cybersecurity Analyst

The Cybersecurity Analyst is a mid-level, hands‑on role within Star Group's IT Security team, reporting to the Cybersecurity Engineer. This position is responsible for day‑to‑day security operations, monitoring, incident response support, vulnerability management, and compliance evidence collection across Star Group's corporate and field environments. The Cybersecurity Analyst works closely with the IT Security Team to maintain and mature the organization's security posture, and serves as a key operational responder for security alerts, tickets, and audit requests.

This role is well suited to a candidate with 3–5 years of hands‑on security operations experience who is looking to deepen expertise across endpoint protection, network access control, secure email gateway, application allow listing, privileged access management, SIEM/SOAR, and vulnerability management in a lean, high‑ownership team environment. The role also offers the opportunity to gain exposure to the strategic development of security policies, the implementation of IT security technologies, and work with cross‑functional teams to deliver targeted security solutions.

• Monitor security alerts and events generated by EDR, NAC, SIEM/SOAR, ZTA, email security, and DLP platforms; triage, investigate, and elevate per documented incident response playbooks.
• Perform first‑line analysis of phishing reports, malware alerts, and suspicious activity; contain and remediate confirmed incidents in coordination with the IT Security Team.
• Support tabletop exercises and post‑incident reviews; contribute to after‑action reports and lessons‑learned documentation.
• Maintain and tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve mean‑time‑to‑detect/respond.
• Perform after‑hours security event containment and remediation activities as needed.

• Run and review recurring vulnerability scans across servers, endpoints, and network infrastructure; validate and prioritize findings by exploitability and business risk.
• Track remediation of vulnerabilities against SLA targets, including expedited handling of CISA Known Exploited Vulnerabilities (KEV).
• Coordinate with broader IT teams on patch deployment cycles for servers, workstations, endpoint devices, and SaaS solutions; verify patch compliance reporting.
• Maintain the vulnerability management dashboard and produce recurring metrics for leadership and audit purposes.

• Assist in administering day‑to‑day operations of Privileged Access Management (PAM) tooling, including onboarding/offboarding privileged accounts, session review, and access certification support.
• Support Network Access Control (NAC) operations, including device onboarding, policy exceptions, and unauthorized‑device investigation across 100+ sites.
• Assist with administering endpoint application control / allow listing policy requests, exception handling, and false‑positive tuning.
• Support quarterly and annual user access reviews (UAR) for in‑scope systems.

• Collect, organize, and validate audit evidence in support of audit requirements, industry assessments and cybersecurity disclosure requirements.
• Track and report on security awareness training completion, phishing simulation results, and related compliance metrics.

• Maintain accurate, current documentation for security tools, configurations, and standard operating procedures (SOPs).
• Contribute to the continuous improvement of playbooks, runbooks, and automation to reduce manual effort and improve consistency.
• Assist in the evaluation and testing…