Information Security Analyst

The Information Security Analyst is a technical role within the Information Security (Info Sec) group of Information Technology Services (ITS), responsible for defending the University's data assets through policy controls, security operations, incident response, and AI-assisted tooling. As a primary network defender, the analyst works at the intersection of threat detection, vulnerability management, and forensic investigation within a Security Operations Center (SOC).

The role requires hands-on experience across several domains: SOC operations including alert triage, log analysis, and network traffic interpretation using tools such as Splunk, Kibana, or Microsoft Sentinel;
Python 3 scripting for automation and detection support; firewall management for ruleset maintenance and network security enforcement;
Microsoft Entra  including identity architecture and Power Shell scripting;
Linux system administration across mixed-OS environments; and digital forensics at a first-responder level, including breach assessment, evidence preservation, and containment.

This role is responsible for developing and overseeing student SOC employees. The SOC functions as both a live security operation and a learning environment, requiring the analyst to serve as senior practitioner and mentor.

Education and Experience

Education

* Bachelor's degree in information security/Cybersecurity, Information Management, Computer Science, Computer Engineering, or related discipline.

Experience

* Five (5+) plus years of experience in Information Technology, with a minimum of two (2) years in Information Security/Cybersecurity.

* Prior experience working in a functioning SOC or equivalent security operations environment is valued, including hands-on work triaging live alerts, investigating active incidents, and operating security tooling in a production setting.

Skills and Knowledge

Required Experience (2+ years each):

* SOC operations: IDS/EDR alert triage, log analysis, and network traffic interpretation using Splunk, Kibana, or Microsoft Sentinel

* Microsoft Defender for Endpoint: alert triage, investigation, and response

* Python 3 scripting for automation and SOC workflow support

* Firewall operation and network security fundamentals

Required Experience (1+ years each):

* Windows/Active Directory, endpoint log analysis, Power Shell, and group policies

* Linux system administration

* Digital forensics at a first-responder level

* AI-assisted security tools (e.g., Copilot, AI-enhanced SIEM features)

* Broader Technical Knowledge:
Network protocols; IDS/IPS platforms; MITRE ATT&CK and Cyber Kill Chain; vulnerability scanning; cloud security fundamentals; SOAR and scripting-based automation;
Microsoft security stack (Defender XDR, Sentinel, Purview, Entra ) with KQL proficiency.

* Active use of AI tooling across all operational functions and the application of AI as a solution is a core expectation.

* Soft Skills:

Cross-functional collaboration; student SOC mentorship; multi-source analytical precision; clear written and verbal communication to technical and non-technical audiences; composure during active incidents; commitment to continuous learning.

Responsibilities

Security Monitoring & Alert Triage

* Monitor network, endpoint, and identity telemetry continuously using open-source and enterprise SIEM platforms including Splunk, Elastic/Open search, and Kibana.

* Review IDS alerts, system logs, and network traffic captures; triage for relevance and severity; distinguish genuine threats from false positives.

* Provide second-level analysis of alerts escalated by student SOC employees, with final disposition and escalation authority resting with this position.

SOC Tools Operations & Engineering

* Operate, tune, and recommend enhancements to the SOC's monitoring and detection platforms including Microsoft Defender and SIEM tools; leverage AI-assisted tooling to improve detection and response workflows.

* Implement threat hunting and detection strategies; identify new data sources to augment detection capability; integrate new tools and applications as needed.

* Write Python and Power Shell scripts to automate detection, response, and data analysis…