Information Security Analyst

We're looking for a hands-on Information Security Analyst to join a Security Operations Center (SOC) environment and help protect enterprise systems, identities, endpoints, networks, and data. This role is best suited for someone who is actively working with the Microsoft security stack today and is comfortable investigating live security events, automating security workflows, and responding to incidents. This is not primarily a governance or policy position.

The successful candidate will be a hands-on security practitioner.

• 2+ years of cybersecurity / information security experience
• 2+ years of current, hands-on Microsoft security experience, including Microsoft Defender for Endpoint and/or Microsoft Sentinel
• 2+ years of automation and scripting experience, particularly Python and Power Shell

Preferred:
Experience with Microsoft Purview

• 5+ years of Information Technology experience, including at least 2 years in Information Security or Cybersecurity
• Experience working within a SOC or comparable security operations environment, including hands-on alert triage, investigation of active incidents, and use of production security tooling
• Experience analyzing endpoint, identity, network, and security event data to identify and respond to threats

Candidates should have 2+ years of hands-on experience with:

• Microsoft Defender for Endpoint, including alert triage, investigation, and response
• SIEM and SOC operations, including IDS/EDR alert triage, log analysis, and network traffic interpretation using Microsoft Sentinel, Splunk, Kibana, or similar platforms
• Python 3 scripting for security automation, data analysis, and SOC workflow support
• Firewall operations and network security fundamentals

• Windows and Active Directory
• Power Shell
• Endpoint log analysis
• Group Policy
• Linux system administration
• Digital forensics and incident response at a first-responder level

• Microsoft Purview
• Microsoft Entra
• AI-assisted security tools, including Microsoft Copilot or AI-enhanced SIEM/security capabilities
• Vulnerability assessment and remediation programs
• Threat hunting and development of detection strategies

• Operate, tune, and recommend improvements to SOC monitoring and detection platforms, with particular emphasis on Microsoft Defender and SIEM technologies
• Triage security alerts and investigate potentially malicious activity
• Develop threat-hunting and detection strategies
• Identify additional data sources that can strengthen threat detection and investigation
• Integrate security tools and applications into SOC workflows
• Write Python and Power Shell scripts to automate detection, response, investigation, and data-analysis processes
• Assist with firewall ruleset maintenance and network security controls

• Serve as a first responder for cybersecurity incidents
• Perform log, endpoint, and system-level analysis to determine the scope and potential impact of security events
• Support containment, eradication, and recovery activities
• Conduct first-responder digital forensic analysis and preserve relevant evidence
• Clearly document and communicate incident findings to technical and non-technical stakeholders

• Support vulnerability scanning and assessment activities
• Analyze security findings and help prioritize remediation based on exploitability and business impact
• Coordinate remediation with system and application owners
• Track patching and validate remediation of critical vulnerabilities

• Help develop, document, and maintain SOC processes, investigation runbooks, and escalation procedures
• Provide guidance and mentorship to developing security analysts
• Coach team members on alert investigation, log analysis, documentation, and incident-response practices

The strongest candidate combines current Microsoft security expertise with hands-on SOC experience. You should be comfortable moving from a Microsoft Defender alert or Sentinel event into an investigation, analyzing multiple data sources, determining risk, documenting findings, and helping drive the appropriate response.

• Strong cross-functional collaboration skills
• Clear written and verbal communication
• Analytical precision across multiple security data sources
• Composure during active security incidents
• Ability to explain technical…