Cybersecurity Analyst - Incident Response & SIEM Triage

Intellect Solutions LLC; Rockville (MD); On-site; USD 90,000 - 130,000; Full time

Job summary

Intellect Solutions LLC is seeking a Cybersecurity Analyst to support the Security Incident Response Team (SIRT) by monitoring, triaging, analyzing, and investigating cybersecurity events across the enterprise. The role works with Senior Analysts and SOC leads to identify malicious activity, escalate appropriately, and maintain investigation documentation.

The candidate will contribute to detection, investigation, and incident response efforts, help mature security monitoring, and participate in

Qualifications

• Experience supporting cybersecurity operations, security monitoring, incident response, or comparable cybersecurity functions.
• Experience reviewing and analyzing security alerts and event data.
• Working knowledge of SIEM technologies, preferably Splunk Enterprise Security.
• Understanding of common cybersecurity threats, attack techniques, and indicators of compromise.
• Familiarity with endpoint, network, identity, authentication, and security-log analysis.
• Understanding of cybersecurity incident-response processes.
• Familiarity with MITRE ATT&CK or comparable threat frameworks.
• Ability to analyze information from multiple security sources and develop defensible conclusions.
• Strong troubleshooting, analytical, documentation, and communication skills.
• Ability to work collaboratively with senior analysts, security engineers, system administrators, and other technical personnel.

Responsibilities

• Monitor and review security alerts generated by Splunk Enterprise Security and other approved cybersecurity technologies.
• Perform initial triage of security events to determine validity, severity, scope, and potential impact.
• Analyze security activity involving users, endpoints, hosts, IP addresses, accounts, applications, and other security-relevant entities.
• Enrich alerts using available endpoint, network, identity, vulnerability, asset, and threat information.
• Distinguish expected or non-actionable activity from activity requiring further investigation.
• Escalate potentially significant cybersecurity events in accordance with established SIRT procedures.
• Conduct cybersecurity investigations under the guidance of the Senior Cybersecurity Analyst and SOC Lead.
• Correlate security events across multiple data sources to identify suspicious behavior and potential attack activity.
• Develop timelines and document relevant evidence associated with security investigations.
• Assist with determining the scope and potential impact of identified cybersecurity activity.
• Support investigation of endpoint, account, network, malware, phishing, policy-violation, and other cybersecurity events.
• Coordinate with appropriate technical teams and system owners when additional information or remediation action is required.
• Support evidence collection and preservation as required by established incident-response procedures.
• Support SIRT response activities during confirmed or suspected cybersecurity incidents.
• Assist with investigation, containment, remediation, recovery, and post-incident activities as assigned.
• Escalate significant findings to the Senior Cybersecurity Analyst, SOC Lead, and appropriate stakeholders.
• Support high-criticality incident-response activities when activation is required.
• Participate in incident reviews and lessons-learned activities.
• Assist with identifying opportunities to improve incident-response procedures and playbooks.
• Provide feedback to the Detection Engineer regarding noisy, ineffective, or insufficiently enriched detections.
• Identify recurring false-positive or non-actionable alert patterns.
• Assist with testing and validating new or modified security detections from an analyst perspective.
• Identify opportunities for automated enrichment, triage, documentation, and other workflow improvements.
• Participate in testing and validation of SOC automation and AI-assisted cybersecurity capabilities.
• Provide operational feedback on whether new tools, detections, and automations improve analyst effectiveness.
• Maintain accurate and timely documentation of security investigations, findings, actions, and dispositions.
• Develop and maintain investigation procedures, playbooks, checklists, and supporting documentation.
• Assist with collection of operational metrics supporting SIRT monthly reporting and continuous improvement.
• Maintain investigation records in approved SIRT systems and repositories.
• Support knowledge sharing and cross-training within SIRT.

Skills

Cybersecurity ops

Incident response

Analytical thinking

Communication skills

Team collaboration

Tools

Splunk Enterprise Security

Microsoft Defender for Endpoint

Tenable

ServiceNow

Job description

Intellect Solutions LLC is seeking a Cybersecurity Analyst to support the Security Incident Response Team (SIRT) by monitoring, triaging, analyzing, and investigating cybersecurity events across the enterprise. The role works with Senior Analysts and SOC leads to identify malicious activity, escalate appropriately, and maintain investigation documentation.

The candidate will contribute to detection, investigation, and incident response efforts, help mature security monitoring, and participate in