Incident Response Analyst: Threat Triage & Mitigation

ArmorPoint, LLC; Phoenix (AZ); On-site; USD 80,000 - 120,000; Full time

Job summary

ArmorPoint, LLC is seeking an Incident Response Analyst to monitor security alerts and manage security incidents across services affecting customers. The role supports SOC by administering security tools and performing in-depth investigations, with emphasis on malware analysis and root-cause determination.

The analyst will communicate findings to non-technical audiences, coordinate with multiple departments for remediation, and contribute to incident post-mortems while staying current on threat

Qualifications

• 3+ years of experience in a SOC or similar role.
• Proficient in malware analysis via sandboxes, OSINT, and related resources.
• Familiar with MITRE ATT&CK framework and cybersecurity methodologies.
• Strong written and verbal communication for technical and non-technical audiences.

Responsibilities

• Investigate and triage suspicious activity and escalate or close events as appropriate using SIEM and approved tools.
• Perform malware analysis through sandboxes, OSINT, and other resources.
• Develop operational procedures to improve incident response processes.
• Monitor security alerts and investigate potential incidents in the tech stack.
• Coordinate remediation tasks with other departments and escalate unresolved incidents.

Skills

SOC operations

Malware analysis

SIEM

Threat hunting

OSINT

Education

High School Diploma or GED

Security+ / CISSP / CEH / EC- IH (preferred)

Tools

SIEM tools

Sandbox analysis tools

Incident response tooling

Job description

ArmorPoint, LLC is seeking an Incident Response Analyst to monitor security alerts and manage security incidents across services affecting customers. The role supports SOC by administering security tools and performing in-depth investigations, with emphasis on malware analysis and root-cause determination.

The analyst will communicate findings to non-technical audiences, coordinate with multiple departments for remediation, and contribute to incident post-mortems while staying current on threat