Cyber Security Analyst

Stefanini Group; Atlanta (GA); On-site; USD 110,000 - 150,000; Full time

Job summary

Stefanini Group is seeking a Cyber Security Analyst with strong Splunk Enterprise and Splunk Enterprise Security experience to monitor, investigate, and respond to cyber threats in a banking and financial services environment.

You will focus on threat-alert triage, incident investigation, threat hunting, and security monitoring across critical financial systems, leveraging Splunk for detection, analysis, and response. The role emphasizes collaboration with SOC processes and MITRE ATT&CK mapping.

Qualifications

• 5+ years of experience in cybersecurity operations, SOC monitoring, or incident response.
• Strong hands-on experience with Splunk and SPL query development.
• Experience in banking, financial services, payments, fintech, or regulated environments.
• Knowledge of financial-sector risks, including fraud, account takeover, payment-system threats, insider risk, and protection of sensitive customer data.
• Familiar with Windows / Linux, network security, identity and access management, EDR, cloud security, and incident‑response processes.

Responsibilities

• Monitor and triage Splunk notable events, correlation searches, dashboards, and risk-based alerts.
• Investigate suspicious authentication, privileged-account activity, malware, phishing, ransomware, data exfiltration, and unauthorized transactions or system access.
• Write and optimize SPL queries for alert investigation, event correlation, and threat hunting.
• Analyze logs from SIEM, EDR, firewalls, VPN, identity platforms, cloud services, applications, and banking systems.
• Validate true and false positives, prioritize alerts by risk, and elevate confirmed incidents according to SOC procedures.
• Develop and tune Splunk correlation searches, dashboards, reports, and detection rules to reduce false positives and improve coverage.
• Support incident response, root-cause analysis, evidence preservation, and post-incident reporting.
• Map threats and detections to MITRE ATT&CK and relevant financial-sector security controls.

Skills

SPL query development

Splunk knowledge

Incident response

Threat monitoring

Financial services domain knowledge

Tools

Splunk

EDR

Job description

We are seeking a Cyber Security Analyst with strong Splunk Enterprise / Splunk Enterprise Security experience to monitor, investigate, and respond to cyber threats within a banking and financial services environment. The role will focus on threat-alert triage, incident investigation, threat hunting, and security monitoring across critical financial systems.

Key Responsibilities:

• Monitor and triage Splunk notable events, correlation searches, dashboards, and risk-based alerts.


• Investigate suspicious authentication, privileged-account activity, malware, phishing, ransomware, data exfiltration, and unauthorized transactions or system access.


• Write and optimize SPL queries for alert investigation, event correlation, and threat hunting.


• Analyze logs from SIEM, EDR, firewalls, VPN, identity platforms, cloud services, applications, and banking systems.


• Validate true and false positives, prioritize alerts by risk, and elevate confirmed incidents according to SOC procedures.


• Develop and tune Splunk correlation searches, dashboards, reports, and detection rules to reduce false positives and improve coverage.


• Support incident response, root-cause analysis, evidence preservation, and post-incident reporting.


• Map threats and detections to MITRE ATT&CK and relevant financial-sector security controls.

Required Qualifications:

• 5+ years of experience in cybersecurity operations, SOC monitoring, or incident response.


• Strong hands-on experience with Splunk and SPL query development.


• Experience in banking, financial services, payments, fintech, or regulated environments.


• Knowledge of financial-sector risks, including fraud, account takeover, payment-system threats, insider risk, and protection of sensitive customer data.


• Familiar with Windows / Linux, network security, identity and access management, EDR, cloud security, and incident‑response processes.


• Strong analysis / key campo