Cybersecurity Analyst

thinkbrg; United States; Remote; USD 90,000 - 120,000; Full time

Job summary

thinkbrg is seeking a Security Operations Analyst to support day-to-day security operations across cloud, identity, email, endpoints, and data environments in the United States. You will investigate alerts, coordinate remediation, and help administer Microsoft security services across Azure, Entra ID, Defender, Sentinel, and Purview.

You will work with technical, risk, and external security teams, following approved access and change processes. Corporate firewall administration is outside scope.

Qualifications

• At least three years in cybersecurity operations, cloud or identity security, security engineering, or a closely related field.
• Working knowledge of Microsoft Azure security and the Microsoft security environment.
• Ability to investigate and communicate security issues, coordinate remediation, and keep accurate records.
• Ability to manage concurrent investigations and workstreams while following change-management requirements.
• Must be able to provide verification of legal authorization to work in the United States without employer sponsorship.

Responsibilities

• Triage, investigate, document, and coordinate responses to security alerts, incidents, tickets, and suspicious activity.
• Work with a managed security provider to validate alerts, track corrective actions, and improve detection quality and workflows.
• Support approved administration of Microsoft security services across Azure, Entra ID, Active Directory, Defender, Sentinel, and Purview.
• Review cloud security findings and support policy, baseline, identity, email, vulnerability, and cloud application control improvements.
• Investigate activity using logs and other evidence, escalating significant events through incident response procedures.
• Track findings to the right technical owners, verify remediation, maintain operational documentation and audit evidence, and contribute to risk reviews and exercises.

Skills

Cybersecurity operations

Cloud security

Incident investigation

Azure security

Record keeping

Tools

Azure Defender

Sentinel

Purview

Entra ID

Active Directory

Job description

Role overview

Support day-to-day security operations across cloud, identity, email, endpoints, and data environments. The analyst investigates alerts and suspicious activity, helps administer security tools and policies, coordinates remediation, and improves controls and documentation. The role works across technical, risk, compliance, and external security teams, following approved access and change processes; corporate firewall administration is outside its scope.

Responsibilities

• Triage, investigate, document, and coordinate responses to security alerts, incidents, tickets, and suspicious activity.
• Work with a managed security provider to validate alerts, track corrective actions, and improve detection quality and workflows.
• Support approved administration of Microsoft security services across Azure, Entra ID, Active Directory, Defender, Sentinel, and Purview.
• Review cloud security findings and support policy, baseline, identity, email, vulnerability, and cloud application control improvements.
• Investigate activity using logs and other evidence, escalating significant events through incident response procedures.
• Track findings to the right technical owners, verify remediation, maintain operational documentation and audit evidence, and contribute to risk reviews and exercises.

Requirements

• At least three years in cybersecurity operations, cloud or identity security, security engineering, or a closely related field.
• Working knowledge of Microsoft Azure security and the Microsoft security environment.
• Ability to investigate and communicate security issues, coordinate remediation, and keep accurate records.
• Ability to manage concurrent investigations and workstreams while following change-management requirements.
• Must be able to provide verification of legal authorization to work in the United States without employer sponsorship.

Nice to have

• Experience in a Microsoft-centered enterprise security operations environment.
• Ability to create KQL queries, workbooks, metrics, or monitoring dashboards.
• Experience piloting security changes, assessing user impact, and documenting exceptions and rollback plans.
• Security credentials such as SC-200, Security+, CySA+, or GIAC certifications; comparable practical experience is also considered.

Benefits and work setup

• Listed annual salary range: $90,000–$120,000.