Cybersecurity Operator

bankerstoolbox; Raleigh (NC); Hybrid; USD 55,000 - 75,000; Full time

Benefits offered by this job

Market competitive total rewards package

Flexible PTO and bank holidays

401(k) plan and company match

Job summary

bankerstoolbox is looking for a Cybersecurity Operator in Raleigh, NC, to monitor and respond to security alerts across corporate and cloud environments. This hybrid-remote role requires attention to detail, communication skills, and a foundational knowledge of cybersecurity principles.

Your responsibilities will include triaging incidents, supporting access management, and running phishing simulations. Candidates with an associate or bachelor’s degree in cybersecurity or a related field are preferred.

The position offers competitive compensation, health benefits, and flexible PTO.

Qualifications

• 0–2 years of relevant cybersecurity or IT experience.
• Foundational understanding of threat detection and incident response.
• Strong attention to detail and ability to follow SOPs.

Responsibilities

• Monitor security alerts across SIEM, EDR, and email security platforms.
• Conduct periodic user access reviews to validate least-privilege alignment.
• Support execution of phishing simulation campaigns.

Skills

Threat detection and incident response

Access management and least privilege principles

Endpoint security and data protection

Network fundamentals (TCP/IP, DNS, HTTP/S)

Education

Associate or bachelor’s degree in cybersecurity, information security, or related field

Tools

SIEM platforms (e.g., Rapid7, Splunk)

EDR solutions (e.g., CrowdStrike, Microsoft Defender)

Microsoft 365 security tooling

AWS or Azure environments

Job description

We provide technology that community financial institutions use to manage risk and drive growth. Our solutions automate key processes – from anti-money laundering to fraud detection to CECL readiness to lending workflows – empowering our customers by addressing their Enterprise Risk Management needs.

The Cybersecurity Operator sits within the Security Operations Team and is responsible for real-time monitoring, triage, and escalation of security events across corporate and cloud environments. This role serves as a frontline defender, analyzing alerts from SIEM, EDR, and email security platforms, and escalating potential threats to Cybersecurity Analysts.

This position also supports recurring security operations activities, including access reviews, phishing simulation reporting, security metrics collection, and audit support. All activities are performed in alignment with established procedures and NIST 800-61 incident response standards, ensuring consistent detection, escalation, and documentation of security events. This role reports to the Director, Security Operations and is hybrid-remote based in our Raleigh, NC office.

What You’ll Do

Alert Monitoring & Incident Triage

• Monitor security alerts across SIEM, EDR, and email security platforms
• Perform first-tier triage, classifying alerts based on known behaviors, false positives, and SOPs
• Document incidents, artifacts, and actions in accordance with NIST 800-61
• Review email quarantine for potential threats and policy violations

Operational Security & Compliance Support

• Conduct periodic user access reviews to validate least-privilege alignment
• Support access recertification campaigns and track completion
• Assist in reviewing security tooling exceptions
• Support audits, assessments, and compliance reviews through evidence collection and validation
• Collect and validate security metrics for leadership dashboards

Security Awareness & Phishing Program Support

• Support execution of phishing simulation campaigns
• Compile and analyze phishing metrics (click rate, reporting rate, credential capture)
• Assist in preparing reports and materials for leadership review

General Security Operations Support

• Assist investigations by gathering logs, artifacts, and supporting data
• Conduct research on emerging threats and vulnerabilities as assigned
• Support security awareness initiatives and onboarding logistics
• Contribute to detection engineering improvements by identifying gaps in telemetry

What You’ll Need:

• Associate or bachelor’s degree in cybersecurity, information security, or related field (preferred)
• 0–2 years of relevant cybersecurity or IT experience
• Foundational understanding of:
  • Threat detection and incident response
  • Access management and least privilege principles
  • Endpoint security and data protection
  • Network fundamentals (TCP/IP, DNS, HTTP/S)
• Strong attention to detail and ability to follow SOPs
• Strong written and verbal communication skills
• Ability to collaborate effectively across teams

Preferred Qualifications:

• Exposure to SIEM platforms (e.g., Rapid7, Splunk)
• Exposure to EDR solutions (e.g., CrowdStrike, Microsoft Defender)
• Familiarity with Microsoft 365 security tooling
• Experience or exposure to AWS or Azure environments
• Entry-level security certifications (Security+, CySA+, ISC2 CC, or similar)

What You’ll Get:

• Market competitive total rewards package
• To be part of theHeart & SOULof a winning company with an inspiringmission
• The opportunity toMake Big Things Happen
• Competitive salary along with full health benefits with an HSA option
• FlexiblePTO and bank holidays
• 401(k) plan and company match

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity, age, genetic trait, sexual orientation, national origin, disability status, or any other characteristic protected by law. Abrigo is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, you may contact us at [e-mail] with the subject line accommodation.