Security Analyst II

Overview

Foresite was founded in 2013 when our group of passionate security professionals saw what a nightmare organizations were facing to stay secure. We founded Foresite Cybersecurity with a mission: empower organizations of all sizes to navigate this ever-changing threat landscape.

Foresite is seeking a Security Analyst II who has a passion for security, a keen eye for detail, and a drive to protect organizations from cyberattacks. It's more than just a job; it's a launching pad for your cybersecurity career and a first step towards an exciting future at Foresite.

The Security Analyst II is a critical mid-level role within Foresite’s Security Operations Center. You will work inside our 24/7 Cyber Fusion Center, handling escalated security alerts, leading complex investigations for our managed customers across Google Security Operations (Chronicle) and our SOAR platform, and serving as a subject matter expert for the broader team. You will leverage your advanced knowledge of our detection stack and customer environments to resolve intricate threats and will act as a mentor and escalation point for our Analyst I team.

• Act as an escalation point
  :
  Serve as the primary point of escalation for our Tier 1 Analysts. You will handle complex event triage escalations, guide junior analysts through difficult dispositions, and provide decisive action on high-severity alerts.

• Be a point of information and mentorship: Act as a knowledge resource for the Analyst 1 team. Answer questions regarding investigations, customer environments, and tool navigation to help upskill the shift.

• Investigate incidents end-to-end: Review complex alert context, gather evidence from Chronicle UDM and supporting tools, reach a final disposition, and either close the ticket with a documented rationale or escalate to Tier 3/Incident Response with a clear handoff.

• Optimize investigation playbooks: Follow established playbooks for the detection stack, but actively identify gaps, propose workflow improvements, and help draft new guidance alongside your Team Lead to improve overall SOC efficiency.

• Communicate clearly in tickets: Every ticket you touch should be understandable by the next analyst, the customer, or an auditor reading it six months from now. Your written analysis is the primary artifact of your work and should set the standard for Tier 1 analysts.

• Partner with customers: Lead communications through the ticketing system on routine and complex investigations, requests for information, and exclusion/suppression requests.

• Meet SLA and quality targets: Consistently meet performance scorecards for time-to-resolve, triage accuracy, and ticket closure quality, setting a benchmark for the shift.

• Contribute to detection fidelity: Actively hunt for noisy rules, false-positive patterns, and alert clusters. Submit highly detailed tuning requests and recommendations to the detection engineering team.

• Participate in shift handoff: Brief the incoming shift on open investigations, anomalies observed, and escalated items waiting on customer response.

• Experience: 2–4 years of prior experience in a SOC, incident response, or dedicated cybersecurity role.

• Advanced knowledge of core security concepts: Deep understanding of the cyber kill chain and MITRE ATT&CK framework, common attack vectors (phishing, credential abuse, malware delivery, lateral movement), and hands-on experience with detection, prevention, and response tactics.

• Proficiency with a SIEM: You have hands-on experience navigating SIEM platforms. You understand how alerts are generated, how to build advanced search queries, and how to pivot seamlessly from an alert to supporting log evidence to build a timeline of events.

• Strong written communication: You will be writing in tickets that customers read. Clear, concise, accurate writing is non-negotiable.

• Attention to detail: False positives and true positives often look nearly identical. You are the analyst who reads the full log line, not the summary, and you teach others to do the same.

• Ability to work an assigned shift on-site in Overland Park: including weekend and holiday coverage as scheduled.

• CompTIA Sec+,…