Information Security Analyst

Information Security Analyst

Job #: 042836

Location: Syracuse, NY

Pay Range: $87,000-$92,000

Hours: Standard University business hours: 8:30am - 5:00pm (academic year); 8:00am - 4:30pm (summer). Hours may vary based on operational needs.

Job Type: Full Time

The Information Security Analyst is a technical role within the Information Security (Info Sec) group of Information Technology Services (ITS), responsible for defending the University’s data assets through policy controls, security operations, incident response, and AI‑assisted tooling. As a primary network defender, the analyst works at the intersection of threat detection, vulnerability management, and forensic investigation within a Security Operations Center (SOC).

The role requires hands‑on experience across several domains: SOC operations including alert triage, log analysis, and network traffic interpretation using tools such as Splunk, Kibana, or Microsoft Sentinel;
Python 3 scripting for automation and detection support; firewall management for ruleset maintenance and network security enforcement;
Microsoft Entra  including identity architecture and Power Shell scripting;
Linux system administration across mixed‑OS environments; and digital forensics at a first‑responder level, including breach assessment, evidence preservation, and containment.

This role is responsible for developing and overseeing student SOC employees. The SOC functions as both a live security operation and a learning environment, requiring the analyst to serve as senior practitioner and mentor.

Education

• Bachelor’s degree in information security/Cybersecurity, Information Management, Computer Science, Computer Engineering, or related discipline.

Experience

• Five (5+) plus years of experience in Information Technology, with a minimum of two (2) years in Information Security/Cybersecurity.
• Prior experience working in a functioning SOC or equivalent security operations environment is valued, including hands‑on work triaging live alerts, investigating active incidents, and operating security tooling in a production setting.

Required Experience (2+ years each)

• SOC operations: IDS/EDR alert triage, log analysis, and network traffic interpretation using Splunk, Kibana, or Microsoft Sentinel
• Microsoft Defender for Endpoint: alert triage, investigation, and response
• Python 3 scripting for automation and SOC workflow support
• Firewall operation and network security fundamentals

Required Experience (1+ years each)

• Windows/Active Directory, endpoint log analysis, Power Shell, and group policies
• Linux system administration
• Digital forensics at a first‑responder level
• AI‑assisted security tools (e.g., Copilot, AI‑enhanced SIEM features)
• Broader Technical Knowledge:
  Network protocols; IDS/IPS platforms; MITRE ATT&CK and Cyber Kill Chain; vulnerability scanning; cloud security fundamentals; SOAR and scripting‑based automation;
  Microsoft security stack (Defender XDR, Sentinel, Purview, Entra ) with KQL proficiency.
• Active use of AI tooling across all operational functions and the application of AI as a solution is a core expectation.
• Soft Skills:
  
  Cross‑functional collaboration; student SOC mentorship; multi‑source analytical precision; clear written and verbal communication to technical and non‑technical audiences; composure during active incidents; commitment to continuous learning.

Security Monitoring & Alert Triage

• Monitor network, endpoint, and identity telemetry continuously using open‑source and enterprise SIEM platforms including Splunk, Elastic/Open search, and Kibana.
• Review IDS alerts, system logs, and network traffic captures; triage for relevance and severity; distinguish genuine threats from false positives.
• Provide second‑level analysis of alerts escalated by student SOC employees, with final disposition and escalation authority resting with this position.

SOC Tools Operations & Engineering

• Operate, tune, and recommend enhancements to the SOC’s monitoring and detection platforms including Microsoft Defender and SIEM tools; leverage AI‑assisted tooling to improve detection and response workflows.
• Implement threat…