Identity Security Operations Analyst

Pho Prime, LLC; Shelton (CT); On-site; USD 65,000 - 90,000; Full time

Benefits offered by this job

Mobility Allowance

Job summary

Subway is seeking a Security Operations Analyst to manage identity security and access-governance as part of the IAM team. You will operate CrowdStrike Falcon Identity Protection, conduct identity threat detection, and coordinate with the Detect & Respond function to keep access least-privileged and auditable.

The role includes Okta governance, SIEM investigations, runbooks, and collaboration with leadership to drive improvements in identity security across the enterprise.

Qualifications

• Bachelor's degree or equivalent work experience.
• 1–3 years in security operations, identity operations, SOC, or IT ops with identity/security scope.
• IAM fundamentals: authentication, MFA, SSO, directory services, least-privilege access.
• Exposure to Okta or comparable identity provider.
• Familiarity with SOC practices: alert triage, escalation, evidence handling.
• Experience with SIEM/analytics; CrowdStrike Next-Gen SIEM a plus; learn CQL.
• Active Directory and Entra ID, Microsoft 365 concepts.
• ITSM platform experience (ServiceNow preferred) in ticket-driven ops.
• Strong written documentation habits for investigations and runbooks.
• Comfort using AI tools in technical work.

Responsibilities

• Operate identity threat detection and response using CrowdStrike Falcon Identity Protection.
• Triage identity-based detections, assess risk, apply policy actions within guardrails.
• Investigate access anomalies end-to-end using Falcon Next-Gen SIEM.
• Participate in incident response for identity incidents; containment actions as needed.
• Run Okta Identity Governance access certifications; manage audits and evidence.
• Apply least-privilege principles; flag over-broad access and evidence collection.
• Investigate and close identity-risk backlog; report progress to leadership.
• Handle Tier-2/3 identity escalations; manage tickets in ServiceNow.
• Publish runbooks and knowledge-base articles for identity security operations.

Skills

IAM fundamentals

SOC practices

Strong documentation

AI tools familiarity

Education

Bachelor's degree in CS/IT/Cybersecurity or related field

Tools

Okta

CrowdStrike Falcon Identity Protection

CrowdStrike Falcon Next-Gen SIEM

ServiceNow

Microsoft Entra ID

Microsoft 365 administration

PowerShell or Python scripting

Job description

Subway is seeking a Security Operations Analyst to manage identity security and access-governance as part of the IAM team. You will operate CrowdStrike Falcon Identity Protection, conduct identity threat detection, and coordinate with the Detect & Respond function to keep access least-privileged and auditable.

The role includes Okta governance, SIEM investigations, runbooks, and collaboration with leadership to drive improvements in identity security across the enterprise.