Information Security Analyst – Junior

Jobtailor; Vitória; Presencial; BRL 55 800 - 100 440; Tempo integral

Resumo da oferta

Jobtailor is seeking an entry-level Information Security Analyst to monitor alerts from SIEM/EDR, assist vulnerability validation, and help run phishing simulations. You will support awareness campaigns, access reviews, and asset inventories while learning from senior analysts.

The role emphasizes collaboration, quick learning, and adherence to LGPD/compliance requirements, with mentorship for growth in detection, incident response, and governance.

Qualificações

• Bachelor's degree in progress or completed in relevant fields.
• Fundamental information security knowledge with CIA triad basics.
• Basic networks and OS concepts, TCP/IP, DNS, HTTP/S; Win/Linux basics.
• Familiarity with access management and least privilege lifecycle.
• Entry-level IT exposure or internships in security/support roles.
• Experience handling tickets and clear written communication.
• Experience in asset inventories, log collection, and document organization.
• Willingness to learn via mentorship and follow established processes.
• Foundational certifications like Security+, ISFS, ISO 27001 Foundation, or AZ-900.

Responsabilidades

• Perform continuous monitoring and triage of security alerts from SIEM/EDR/perimeter tools.
• Assist with initial validation of vulnerabilities from automated scans.
• Support simulation of attack tactics (MITRE ATT&CK) to validate detections.
• Assist in preliminary phishing analysis and IoC collection in sandbox envs.
• Support monitoring of SWG rules, content filtering, and DLP incidents.
• Support user access review campaigns and AD/Azure AD reports.
• Assist in provisioning and auditing of logical accounts; enforce least privilege.
• Collect, organize, and sanitize security evidence for audits and LGPD.
• Collaborate on asset inventories, IT risk mapping, and third-party questionnaires.
• Support security awareness campaigns and phishing simulations (KnowBe4).
• Promote security/privacy practices and assist onboarding of new hires.
• Pursue technical development through mentorship in detection and IR.

Conhecimentos

InfoSec basics

Networking basics

OS basics (Windows/Linux)

Access management concepts

Ticket handling

Formação académica

Bachelor's degree in Systems Analysis, Information Security, Computer Science, Computer Engineering, Computer Networks, or related fields

Descrição da oferta de emprego

Responsibilities

• Perform continuous monitoring and triage of security alerts generated by the SIEM (Google SecOps or similar), EDR, and perimeter tools;
• Assist with initial validation of vulnerabilities discovered by automated scans, recording findings to support the team's remediation plans;
• Support the simulation of basic attack tactics and techniques based on industry frameworks (such as MITRE ATT&CK), helping validate that internal alerts and detection rules are functioning;
• Assist with preliminary analysis of suspicious emails (phishing) and artifacts in controlled sandbox environments (such as Any.Run), extracting initial indicators of compromise (IoCs) under supervision;
• Support monitoring of basic secure web gateway (SWG) rules, content filtering, and data loss prevention (DLP) incidents;
• Support operational execution of user access review campaigns, assisting with extraction of directory reports (Active Directory/Azure AD) and following up with managers for responses;
• Assist in provisioning and basic auditing of logical accounts, helping ensure the practical application of the principle of least privilege;
• Act as support in the collection, organization, and sanitization of technical security evidence to meet internal/external audits and LGPD (Brazilian General Data Protection Law) requirements;
• Collaborate in maintaining asset inventories, basic IT risk mapping, and third‑party security assessment questionnaires;
• Support operational execution of information security awareness campaigns, assisting with configuration and launching of social engineering (phishing) simulations using tools like KnowBe4;
• Promote security best practices, privacy, and responsible credential use in day‑to‑day operations, serving as a point of contact for basic questions for new hires (onboarding) and technology teams;
• Actively pursue technical development through mentorship from more experienced team members (Senior Analysts and Specialists), absorbing knowledge in detection engineering, incident response, and corporate governance.

Requirements

• Bachelor's degree in progress or completed in Systems Analysis, Information Security, Computer Science, Computer Engineering, Computer Networks, or related fields;
• Fundamental knowledge of information security: understanding of the Confidentiality, Integrity, and Availability (CIA) triad, plus basic concepts of vulnerabilities and common threats (such as phishing and malware);
• Basic knowledge of networks and operating systems: understanding how network protocols (TCP/IP, DNS, HTTP/S) work and basic navigation/administration in Windows and Linux environments;
• Familiarity with access management concepts: understanding the principle of least privilege and the lifecycle of user accounts in corporate environments;
• Initial experience or practical exposure (including internships, technical support, service desk, infrastructure operations/NOC, or related IT areas), demonstrating affinity for technology routines;
• Experience handling tickets or providing user support, demonstrating good communication and interpersonal skills to resolve operational questions;
• Familiarity with performing structured routines, such as filling asset inventories, extracting basic system reports, collecting logs, or organizing documents;
• Track record of collaborative work, showing openness to receive technical mentorship, ability to learn quickly, and discipline to follow processes established by leadership.
• Entry‑level or foundational certifications that demonstrate genuine interest and pursuit of specialization in the area, such as: CompTIA Security+, Exin ISFS, ISO/IEC 27001 Foundation, or fundamental cloud credentials (AWS Cloud Practitioner / Azure Fundamentals – AZ‑900).

Core Competencies

Demonstrates foundational knowledge in information security principles, including the CIA triad, and practical experience with security tools and processes. Proficient in user access management, vulnerability assessment, and incident response, with a commitment to continuous learning and collaboration.