Information Security Administrator

ITA Group; Des Moines, West Des Moines (IA, IA); On-site; USD 85,000 - 125,000; Full time

Job summary

ITA Group in Des Moines, IA is seeking an Information Security Administrator to join our security operations team. You will monitor alerts, conduct triage, and partner with MDR to strengthen incident response and playbooks.

You will also administer security technologies across endpoints, cloud, and networks, investigate anomalies, and coordinate remediation with IT and cloud teams to reduce risk.

Qualifications

• Bachelor's or associate degree in cybersecurity or related field; equivalent professional experience may be considered.
• Three to five years of IT/ information security experience in security operations or related field.
• One to two years of security monitoring, alert triage, incident investigation, or vulnerability management.
• Experience in help desk, SOC, MDR, MSSP, or similar environments.
• Current CompTIA Security+ or CySA+ certification.
• Knowledge of SOC processes, log analysis, event correlation, and incident response.
• Understanding of OSI model, TCP/IP, DNS, HTTP/HTTPS, TLS, ports and protocols.
• Familiarity with Microsoft 365, Azure, AWS authentication and privileged access concepts.
• Strong customer service, troubleshooting, and cross-functional collaboration.
• Ability to work time needed to complete projects and meet deadlines.

Responsibilities

• Monitor and investigate alerts from MDR/SIEM, EDR/XDR, identity, endpoint, network, cloud, email, and other platforms.
• Perform initial triage to determine credibility, scope, severity, and business impact; document findings.
• Validate MDR investigations and actions; independently investigate when evidence is incomplete or high risk.
• Partner with MDR to tune detections, reduce false positives, and mature incident-response playbooks.
• Participate in containment, eradication, recovery, and post-incident reviews.
• Coordinate investigations and remediation with infrastructure, networking, cloud, and Service Desk teams.

Skills

Security operations

Incident response

Threat detection

Vulnerability management

SOC processes

Log analysis

Cross-functional collaboration

Customer service

Independent investigation

MDR collaboration

Education

Bachelor's or Associate in cybersecurity or related field

Tools

PowerShell

Python

KQL

SIEM

EDR/XDR

CASB/DLP tools

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Information Security Administrator

Full Time Technical Office - Des Moines, IA West Des Moines, IA, US

2 days ago Requisition ID: 2001

POSITION PURPOSE

The Information Security Administrator supports the protection of ITA Group's systems, networks, endpoints, cloud environments, applications, and data. This role performs security operations, investigates alerts, administers security technologies, supports incident response, and partners with internal technology teams and the organization's external Managed Detection and Response (MDR) provider.

The Administrator is expected to be technically curious and capable of independently performing security triage and investigation when needed. The MDR is an operational partner, but internal accountability remains with ITA Group. This position validates provider findings, challenges incomplete conclusions, helps tune detections and playbooks, and contributes to the continued maturity of security operations.

ACCOUNTABILITIES & PERFORMANCE EXPECTATIONS

Security Operations, Incident Response, and MDR Partnership

• Monitor and investigate alerts from MDR/SIEM, EDR/XDR, identity, endpoint, network, cloud, email, proxy, CASB, DLP, and vulnerability platforms.
• Perform initial and intermediate triage to determine credibility, scope, severity, and business impact; document findings and recommended actions.
• Validate MDR investigations, severity assignments, and recommended response actions; independently investigate when evidence is incomplete, inconsistent, or high risk.
• Partner with the MDR to tune detections, reduce false positives, improve escalation criteria, and mature joint incident-response playbooks and operating procedures.
• Participate in containment, eradication, recovery, post-incident review, and root-cause analysis activities.
• Coordinate investigations and remediation with infrastructure, networking, cloud, application, Service Desk, and third-party teams.

Security Technology and Control Administration

• Support administration and health monitoring of endpoint security, EDR/XDR, secure web gateway/proxy, SIEM, CSPM, CASB, DLP, vulnerability management, and related security platforms.
• Investigate malware, suspicious processes, authentication anomalies, risky cloud activity, data movement, policy violations, and abnormal network or web traffic.
• Review CSPM findings across Microsoft Azure, AWS, Microsoft 365, and other supported platforms; assist owners with prioritization, remediation, and validation.
• Support CASB and DLP policies and investigations involving cloud applications, email, endpoints, collaboration platforms, web traffic, and removable media.
• Perform routine platform maintenance, policy updates, testing, agent deployment support, integrations, vendor coordination, and lifecycle activities.

Vulnerability and Application Security

• Review and prioritize vulnerabilities affecting endpoints, servers, network devices, cloud resources, applications, and externally facing services.
• Track remediation and validate corrective actions using severity, exploitability, exposure, asset criticality, and business context.

REQUIRED QUALIFICATIONS

• Associate or bachelor's degree in cybersecurity, information security, information technology, computer science, networking, or a related field; equivalent professional experience may be considered.
• Three to five years of combined experience in information technology, information security, security operations, systems administration, network support, cloud operations, or a related technical discipline.
• At least one to two years of direct experience performing security monitoring, alert triage, incident investigation, vulnerability management, or security-platform administration.
• Prior technical experience in a help desk, desktop support, network operations, systems administration, cloud support, SOC, MDR, MSSP, or similar environment.
• Current CompTIA Security+ or CySA+ certification. Equivalent or more advanced security certifications may be considered when supported by relevant practical experience.
• Working knowledge of security operations, SOC processes, alert triage, incident response, log analysis, and event correlation.
• Ability to independently assess whether activity is legitimate, suspicious, or malicious and to collect and document supporting evidence.
• Applied understanding of the OSI model, TCP/IP, DNS, HTTP/HTTPS, TLS, common ports and protocols, routing, VPNs, firewalls, and network traffic flows.
• Familiarity with endpoint security, secure web gateways/proxies, SIEM, CSPM, CASB, DLP, vulnerability scanning, cloud security, identity security, and application-security testing.
• Familiarity with Microsoft 365, Microsoft Entra ID, Microsoft Azure, AWS, authentication, authorization, multifactor authentication, and privileged access concepts.
• Strong customer service, troubleshooting, analytical, written, verbal, and cross-functional collaboration skills; ability to handle sensitive information appropriately.
• Ability to listen, understand and respond to external and internal customers’ needs in a timely manner; customer service experience in a service-related industry preferred.
• Ability to work the time necessary to complete projects and/or meet deadlines.

PREFERRED QUALIFICATIONS

• Experience working for or directly with an MDR provider, MSSP, internal SOC, or managed security-monitoring service.
• Experience validating third-party investigations, independently performing follow-up analysis, and improving alert tuning, escalation criteria, or playbooks.
• Experience with endpoint security, SIEM, secure web gateway/proxy, CSPM, CASB, DLP, vulnerability management, or application-security tools.
• Familiarity with PowerShell, Python, KQL, SQL, regular expressions, CIS Controls, NIST CSF, MITRE ATT&CK, PCI DSS, SOC 2, or ISO 27001.

To perform this job successfully, an individual must be able to complete each essential duty satisfactorily. The requirements listed above are representative of the knowledge, skill and/or ability required.

ITA Group, Inc. is an Equal Opportunity Employer. In compliance with the Americans with Disabilities Act, the Company will consider reasonable accommodations for qualified individuals with disabilities and encourage prospective employees and incumbents to discuss potential accommodations with the Company.