Information Security Analyst III

Kforce Inc; Charlotte (NC); On-site; USD 90,000 - 120,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

HSA

FSA

401(k)

Life insurance

Disability insurance

Paid time off

Job summary

Kforce Inc in Charlotte, NC is seeking an Information Security Analyst III to join the Security Operations Center (SOC) within Threat Operations. You will own task management, coordination, and reporting for cybersecurity, trust & safety, and fraud incidents, ensuring timely and clear communication at every stage.

The role requires coordinating the full incident lifecycle—from containment to closure—while developing playbooks, producing regular incident reports, and guiding enhancements across

Qualifications

• Bachelor's degree or equivalent experience.
• 3+ years of incident coordination or security operations experience.
• CISM, GCIH, PMP, ITIL certifications are a plus.

Responsibilities

• Serve as the primary coordinator for major cybersecurity, trust & safety, and fraud incidents: organizing tasks, tracking progress, and maintaining clear communication across teams in ServiceNow SIR.
• Coordinate the full incident lifecycle: containment, eradication, recovery, and closure, ensuring containment is validated against the client’s control-testing standard before an incident is marked resolved.
• Develop, maintain, and enforce incident response playbooks and protocols with SOC capability champions across Insider Risk, Escalations, and DFIR.

Skills

Incident coordination

Security operations

Incident response procedures

ServiceNow SIR

Communication skills

Education

Bachelor's degree in Information Security or related field

Tools

ServiceNow

Job description

Responsibilities

A client with Kforce is seeking an Information Security Analyst III to join their team in Charlotte, AZ. Summary: The client is seeking a detail-oriented and organized Information Security Analyst III to join the Security Operations Center (SOC) within Threat Operations. The candidate will own task management, coordination, and reporting for cybersecurity, trust & safety, and fraud incidents across the organization, ensuring timely and effective resolution and clear communication at every stage.

• Serve as the primary coordinator for major cybersecurity, trust & safety, and fraud incidents: organizing tasks, tracking progress, and maintaining clear communication across all involved teams and stakeholders in ServiceNow Security Incident Response (SIR)
• Coordinate the full incident lifecycle: containment, eradication, recovery, and closure, ensuring containment is validated against the client's control-testing standard before an incident is marked resolved
• Develop, maintain, and enforce incident response playbooks and protocols in partnership with SOC capability champs across Insider Risk, Escalations, and DFIR, ensuring consistency without duplicating existing ownership
• Produce regular incident reporting, from operational status updates to board/SLT-level summaries, with clear actions taken, outcomes, and recommendations for improvement
• Run the lessons-learned loop: facilitate post-incident hot washes, convert findings into documented action items, and drive report/playbook updates on a regular cadence rather than ad hoc
• Provide clear, comprehensive documentation and updates to relevant internal partners, including IT, Legal, Compliance, and Customer Support
• Support onboarding and training for team members on incident response protocols and tooling, reinforcing adherence to established SOC processes
• Stay current on incident response and fraud/trust & safety best practices, adapting SOC processes as threats and requirements evolve

Requirements

• Bachelor's degree in Information Security, Computer Science, Management Information Systems, or a related field, or equivalent experience
• Relevant certifications a plus: PMP, ITIL, CISM, or GCIH
• Minimum 3 years of experience in incident coordination, security operations, or a closely related field
• Solid working knowledge of incident response procedures across cybersecurity, trust & safety, and fraud contexts
• Excellent organizational, written, and verbal communication skills; Able to translate technical detail for non-technical audiences and vice versa
• Comfort working across Insider Risk, Escalations, and DFIR functions without owning their technical domains directly
• Demonstrated ability to manage multiple concurrent incidents, tasks, and stakeholders in a high-pressure environment while maintaining accuracy and composure
• Experience with ServiceNow Security Incident Response (SIR) or a comparable ITSM/SIR platform strongly preferred

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.