Incident Response Analyst

ArmorPoint; Phoenix (AZ); On-site; USD 80,000 - 120,000; Full time

Job summary

ArmorPoint, LLC is seeking an Incident Response Analyst to monitor security alerts and manage security incidents across services affecting customers. The role supports SOC by administering security tools and performing in-depth investigations, with emphasis on malware analysis and root-cause determination.

The analyst will communicate findings to non-technical audiences, coordinate with multiple departments for remediation, and contribute to incident post-mortems while staying current on threat

Qualifications

• 3+ years of experience in a SOC or similar role.
• Proficient in malware analysis via sandboxes, OSINT, and related resources.
• Familiar with MITRE ATT&CK framework and cybersecurity methodologies.
• Strong written and verbal communication for technical and non-technical audiences.

Responsibilities

• Investigate and triage suspicious activity and escalate or close events as appropriate using SIEM and approved tools.
• Perform malware analysis through sandboxes, OSINT, and other resources.
• Develop operational procedures to improve incident response processes.
• Monitor security alerts and investigate potential incidents in the tech stack.
• Coordinate remediation tasks with other departments and escalate unresolved incidents.

Skills

SOC operations

Malware analysis

SIEM

Threat hunting

OSINT

Education

High School Diploma or GED

Security+ / CISSP / CEH / EC- IH (preferred)

Tools

SIEM tools

Sandbox analysis tools

Incident response tooling

Job description

Position Summary:The Incident Response (IR) Analyst is responsible for monitoring security alerts and events of a critical nature to identify, contain and remediate security incidents across various services impacting the company’s customers. The IR Analysts support the SOC team through the management and administration of security and monitoring tools.Essential Duties:Thoroughly investigate and triage suspicious/malicious activity and escalate or closes events, as applicable utilizing the SIEM and other relevant 3rd party (approved) tools.Perform Malware analysis through sandboxes, OSINT, and other resources.Develop operational procedures to implement and continually improve the incident response processes.Monitor security alerts within the tech stack, and investigate any potential security incidents.Monitors incoming event queues for potential security incidents according to established operational procedures.Analyze the alerts received to classify and assess the impact, managing high priority incidents, including communication to the business, facilitating root cause analysis and resolution.Perform cyber security investigations as part of the incident analysis.Ability to summarize and communicate technical data for non-technical audiences.Coordinate with other departments the remediation tasks to be performed and escalate unresolved incidents.Responsible for researching, performing risk analysis, and security audits.Provide technical and incident response support.Identify and investigate potential computer and network intrusions.Perform post-mortem analysis to identify root causes and design controls or measures to prevent future incidents.Identify, interpret, and report security vulnerabilities on systems and networks.Write comprehensive investigation reports capturing investigation details and root cause analysis aligned knowledge of modern Tactics, Techniques, and Procedures (TTPs) for internal/customer purposes.Establish and maintain communication during Incident Response, written and/or via phone.Perform research on emerging threat sources/vulnerabilities.Develop protection strategies.Initiate and aid facilitation of Incident call bridge with the appropriate members (internal/customer resources). This includes summarizing activity, providing next steps or recommendations.Create or collaborate content production for security awareness (both internal and external) including for Trapp Technology – ArmorPoint social media platforms.Participates in Trapp Technology - ArmorPoint internal meetings and required trainings.Ability to effectively communicate with all levels of an organization.Maintains a professional image and demonstrates an understanding of and follows all Trapp Technology – ArmorPoint Policies and Procedures.Between incidents, independent research and self-study to stay up-to-date on new technologies, security trends, and the overall threat landscape.Other duties as assigned.High School Diploma or GED equivalent, requiredSecurity +, CISSP, CEH, and/or ECIH Certification, preferred3+ years of experience in a SOC or similar roleDemonstrated experience and understanding of cyber risks and threats related to cyber attacksFunctional knowledge of MITRE ATT&CK framework and other cybersecurity methodologiesStrong research ability, critical thinking, and reasoning skillsExperience with malware analysis through sandboxes, OSINT, and other resourcesAbility to communicate with all levels of an organizationAbility to follow detailed procedures and policies.Ability to compose grammatically correct, concise, and accurate notesPossess good troubleshooting skills and be able to isolate and fix problems quicklyExceptional organization and time management skills.Excellent written and verbal communication skills.Provides strong customer service to internal and external customers.Ability to manage multiple tasks and deadlines in a fast-paced environment.