Cyber Incident Response Triage Analyst

Cybersecurity Jobs; Philadelphia (Philadelphia County); Hybrid; USD 60,000 - 139,000; Full time

Job summary

Comcast in Philadelphia is seeking a security operations center (SOC) analyst to monitor signals, investigate incidents, and drive case closure with strong documentation and SLA discipline. This hybrid role in Philadelphia, PA supports 24x7 operations, with nights, weekends, or on-call rotations as needed.

You will own the incident lifecycle from intake through closure, applying analytical judgment to distinguish benign activity from true threats, while contributing to detection tuning and

Qualifications

• 2-4+ years in cybersecurity, SOC, or incident response.
• Experience monitoring production security alerts.
• Familiarity with SIEM, SOAR, EDR, and related tools.
• Understanding of networks, operating systems, and security controls.
• Knowledge of phishing, malware, credential abuse, and lateral movement.

Responsibilities

• Monitor security tools for alerts, suspicious activity and threats.
• Triage and resolve high-volume security events and incidents.
• Open, manage and close incidents with accurate classification and documentation.
• Conduct deeper analysis including event correlation and alert enrichment.
• Determine alert validity and appropriate response actions.
• Follow playbooks to contain, eradicate and recover from incidents.

Skills

SOC

Incident response

Analytical thinking

Networking basics

Threat knowledge

AI fundamentals

Education

Bachelor’s Degree

Tools

SIEM

SOAR

EDR

Python

PowerShell

Job description

Join a high-volume SOC environment where you will monitor security signals, investigate real incidents, and close cases with strong documentation and SLA discipline. This hybrid role in Philadelphia, PA supports 24x7 operations, with nights, weekends, or on-call rotations as needed. You will own the incident lifecycle from intake through closure, applying analytical judgment to separate benign activity and false positives from true threats, while contributing to detection tuning and response process improvements.

What you will do

• Monitor security tools and platforms for alerts, suspicious activity, and potential threats
• Triage, investigate, and resolve a high volume of security events and incidents
• Independently open, manage, and close incidents with accurate classification and documentation aligned to SLA requirements
• Perform deeper analysis beyond entry-level triage, including event correlation and alert enrichment
• Determine alert validity, impact, and appropriate response actions
• Execute containment, eradication, and recovery steps using established playbooks
• Identify intrusion methods, affected systems, and potential scope during investigations
• Escalate complex, ambiguous, or high-risk incidents to senior analysts as appropriate
• Maintain working knowledge of common threats, vulnerabilities, attack techniques, and adversary behaviors
• Identify false positives and recommend opportunities for detection tuning and process improvement
• Assist with audits, reporting, and investigative support activities
• Prepare clear and concise incident documentation and summaries for operational tracking and reporting
• Participate in After Action Reviews (AARs) and contribute to response and process improvements
• Follow standard operating procedures, playbooks, and escalation paths
• Operate effectively in a high-volume incident handling environment and maintain consistent case accuracy

Tools and technologies you will work with

• SIEM, SOAR, EDR
• Python, PowerShell
• LLMs, AI agents, GPT, Claude, Anthropic

What you bring

• 2-4 years of experience in cybersecurity, SOC, or incident response
• Experience monitoring and responding to security alerts in a production environment
• Familiarity with SIEM, SOAR, EDR, and related security tools
• Understanding of networking fundamentals, operating systems, and common security controls
• Knowledge of common attack techniques, including phishing, malware, credential abuse, and lateral movement
• Strong analytical, problem-solving, and decision-making skills
• Basic knowledge of AI fundamentals, including LLMs, AI agents, skills, and differences between leading AI models and platforms such as GPT, Claude, and Anthropic

Preferred qualifications

• Experience working in a 24x7 SOC or Incident Response environment
• Familiarity with threat intelligence platforms and alert enrichment processes
• Exposure to scripting or automation (Python, PowerShell)
• Experience supporting audits or compliance-driven environments
• Knowledge aligned to incident response frameworks (including NIST lifecycle concepts)

Eligibility and notice

This position is ineligible for visa sponsorship. To be considered, you must be legally authorized to work in the United States and not require sponsorship for employment now or in the future.

Education

Bachelor’s Degree. Possessing the stated degree is preferred, and Comcast may also consider applicants with some combination of coursework and experience, or extensive related professional experience.

Compensation

National Pay Range: $59,512.60 USD - $139,482.65 USD

Additional pay ranges vary by location (including IL, CO, HI, DC, MD, MN, NY, WA, NJ, VT, MA, VA, ME, CT, and CA).

EEO statement: Comcast is an EOE/Veterans/Disabled/LGBT employer.