Information Security Analyst

Cisive Inc.; Maryland; On-site; USD 90,000 - 130,000; Full time

Job summary

Cisive Inc. is seeking a Security Operations professional in Maryland to monitor SIEM, manage vulnerability lifecycle, and support endpoint and network security.

You will conduct threat hunting, incident response, and collaborate with IT and engineering to embed security best practices. Required 3–5 years in information security, hands-on SIEM (Splunk, Sentinel), vulnerability tools (Nessus/Qualys), and knowledge of SOC 2/NIST CSF.

Qualifications

• 3–5 years of information security experience with operational and compliance exposure.
• Hands-on with SIEM platforms (Splunk or Microsoft Sentinel).
• Experience with vulnerability management tools (Nessus/IO or Qualys).
• Knowledge of SOC 2 Trust Services Criteria and NIST CSF.
• Familiarity with MITRE ATT&CK and common attack techniques.
• Strong written and verbal communication; able to translate findings for non-technical audiences.

Responsibilities

• Monitor, tune, and triage alerts across the SIEM platform.
• Manage vulnerability lifecycle: scanning, remediation tracking, reporting.
• Support endpoint, email, and network security tooling; suggest config improvements.
• Conduct threat hunting and develop detection rules and playbooks.
• Participate in incident response activities including containment and post-incident reviews.

Skills

Analytical thinking

Strong communication

Team collaboration

Tools

Splunk

Microsoft Sentinel

Tenable Nessus/IO

Qualys

Archer

ServiceNow GRC

Drata

Vanta

Job description

It's fun to work in a company where people truly BELIEVE in what they're doing!

We're committed to bringing passion and customer focus to the business.

Job Description

• Security Operations & Tooling
• Monitor, tune, and triage alerts across the SIEM platform, escalating confirmed incidents per established runbooks
• Manage the vulnerability management lifecycle— including scanning, prioritization, remediation tracking, and executive reporting
• Support endpoint security, email security, and network monitoring tools; identify gaps and recommend configuration improvements
• Conduct periodic threat hunting activities and contribute to the development of detection rules and playbooks
• Participate in incident response activities including containment, eradication, and post-incident reviews

Governance, Risk & Compliance (GRC)

• Support ongoing SOC 2 Type II compliance efforts, including evidence collection, control testing, and coordination with external auditors
• Assist with NIST CSF assessments — mapping current controls to framework functions and identifying gaps for remediation
• Maintain and update security policies, standards, and procedures in collaboration with senior team members
• Conduct periodic security risk assessments and contribute findings to the organization risk register
• Track remediation efforts for identified risks and control deficiencies through to closure

Collaboration & Communication

• Partner with IT, Engineering, and business stakeholders to embed security best practices into day-to-day operations
• Assist in security awareness initiatives and provide guidance to staff on security topics
• Prepare clear, concise reporting on security metrics, vulnerability status, and compliance posture for management

Qualifications

Required

• 3–5 years of experience in an information security role with exposure to both technical operations and compliance functions
• Hands-on experience with SIEM platforms (Splunk, Microsoft Sentinel, or equivalent)
• Working knowledge of vulnerability management tools such as Tenable Nessus/IO or Qualys
• Demonstrated understanding of SOC 2 Trust Service Criteria and NIST Cybersecurity Framework
• Familiarity with common attack techniques and defensive countermeasures (MITRE ATT&CK familiarity a plus)
• Strong analytical and problem-solving skills with the ability to work both independently and collaboratively
• Excellent written and verbal communication skills; ability to translate technical findings for non-technical audiences

Preferred

• Relevant certifications such as CompTIA Security+, CySA+, CEH, CISM, or equivalent
• Experience supporting a SOC 2 audit from end to end
• Scripting or automation skills (Python, PowerShell) for security tooling and reporting
• Exposure to cloud security (AWS, Azure, or GCP) environments
• Experience working with GRC platforms (e.g., Archer, ServiceNow GRC, Drata, Vanta)