Cybersecurity Analyst

PowerGrid Services; Hartselle (AL); Presencial; USD 70.000 - 100.000; Jornada completa

Descripción de la vacante

PowerGrid Services is seeking an operate security analyst to drive vulnerability management, alert triage, and endpoint security across our Microsoft 365 and Defender ecosystem. You will run Rapid7 scans, prioritize risks, and coordinate remediation with IT owners while supporting incident response.

The role involves managing SentinelOne policies, reviewing security findings and DLP alerts, and collaborating with infrastructure teams to close policy gaps.

Formación

• 2–4 years of hands-on experience in security operations, security analysis, or a closely related IT security role.
• Experience with Rapid7 (InsightVM and/or InsightIDR) or a comparable vulnerability management or SIEM platform.
• Hands-on experience with SentinelOne or another enterprise EDR such as CrowdStrike or Defender for Endpoint.
• Experience with Barracuda or another email security gateway and understanding of SPF, DKIM, DMARC.
• Working knowledge of the Microsoft ecosystem: AD, Entra ID, M365, Intune, Windows Server.
• Knowledge of networking and common attack techniques, including MITRE ATT&CK.
• Basic PowerShell scripting ability, or willingness to learn.

Responsabilidades

• Run Vulnerability/Exposure Management tasks including Rapid7 scans, asset coverage, and scan scheduling.
• Prioritize findings by risk, track remediation with IT owners, and report SLA performance.
• Validate patches and configuration fixes; manage risk-acceptance exceptions.
• Handle alerts from Rapid7 InsightIDR, SentinelOne, and Defender; coordinate with 24x7 SOC.
• Flag noisy or low-value detections and support incident response triage and post-incident reviews.
• Manage day-to-day SentinelOne console tasks and investigate threats using Deep Visibility/Storyline.
• Work with Intune and Defender admins to avoid policy gaps; review Entra ID and Microsoft 365 security findings.
• Write/run incident playbooks, gather evidence, and support audits and compliance.

Conocimientos

Rapid7 InsightVM/InsightIDR

SentinelOne / Defender for Endpoint

Barracuda Email Security

Microsoft 365 / Entra ID / Intune

Networking concepts (TCP/IP, DNS, VPN)

MITRE ATT&CK knowledge

Incident investigation & reporting

PowerShell scripting

Educación

Bachelor's degree in cybersecurity / CS / IT or related field

Herramientas

Rapid7 InsightVM/InsightIDR

SentinelOne

Barracuda Email Protection

Microsoft Defender for Endpoint

Descripción del empleo

What You'll Do

Vulnerability and Exposure Management

• Run Rapid7 InsightVM scans, maintain asset coverage and scan schedules, and keep credentialed scanning healthy.
• Prioritize findings by risk and exploitability, track remediation with IT owners, and report on SLA performance.
• Validate patches and configuration fixes, and manage exceptions through our documented risk-acceptance process.

Alert Triage and Response

• Work alerts from Rapid7 InsightIDR, SentinelOne, and Microsoft Defender, and coordinate with our 24x7 SOC on escalations.
• Flag noisy or low-value detections to the engineering team so they can be tuned.
• Support incident response by handling initial triage and containment steps per our playbooks, documenting findings, and contributing to post-incident reviews.

Endpoint Security

• Handle day-to-day SentinelOne console work: policies, exclusions, device groups, and agent health.
• Investigate threats using SentinelOne Deep Visibility and Storyline data, and perform remediation and rollback when needed.
• Work with the engineering team and Intune and Defender administrators to avoid policy gaps and conflicts.

Email Security

• Handle daily Barracuda Email Protection work: quarantine management, allow and block lists, and impersonation and phishing alerts.
• Investigate reported phishing and suspicious messages, and remove malicious email from affected mailboxes.
• Pass false positive and tuning findings to the engineering team, and support security awareness efforts with phishing trends and simulation results.

Microsoft Environment

• Review Entra ID, Active Directory, and Microsoft 365 security findings, including Secure Score and CIS benchmark gaps, and apply approved changes.
• Monitor DLP and sensitivity label alerts and handle policy match reviews.
• Partner with the infrastructure team on remediation items.

Documentation and Reporting

• Write and maintain runbooks, incident playbooks, and procedures.
• Collect evidence and support audit and compliance requests.
• Produce clear metrics and status reports for IT leadership.
• Participate in an on-call rotation for security incidents.

What You Bring

• 2 to 4 years of hands-on experience in security operations, security analysis, or a closely related IT security role.
• Experience with Rapid7 (InsightVM and/or InsightIDR) or a comparable vulnerability management or SIEM platform.
• Hands-on experience with SentinelOne or another enterprise EDR such as CrowdStrike or Defender for Endpoint.
• Experience with Barracuda or another email security gateway such as Proofpoint, Mimecast, or Check Point, and a working understanding of SPF, DKIM, and DMARC.
• Working knowledge of the Microsoft ecosystem: Active Directory, Entra ID, Microsoft 365, Intune, and Windows Server.
• Working knowledge of networking (TCP/IP, DNS, firewalls, VPN) and common attack techniques, including MITRE ATT&CK.
• Experience investigating incidents and documenting findings clearly for technical and non-technical audiences.
• Basic PowerShell scripting ability, or a willingness to learn.
• Bachelor's degree in cybersecurity, computer science, IT, or a related field, or equivalent experience.

Nice to Have

• Familiarity with NERC CIP or other critical infrastructure compliance requirements.
• Exposure to OT/ICS environments.
• Experience with Microsoft Sentinel, KQL, or SOAR automation.
• Knowledge of NIST CSF, NIST 800-53, or CIS Controls.
• Interest in AI security and governance, including securing enterprise AI tools and managing unsanctioned AI apps.
• Certifications such as Security+, CySA+, GCIH, GSEC, SC-200, AZ-500, or CISSP (or progress toward one).