Onsite Network Security Analyst II – Austin

Socket.dev; Austin (TX); On-site; USD 80,000 - 120,000; Full time

Job summary

ASSYST is seeking a Network Security Analyst in Austin, TX to monitor, triage, and investigate cybersecurity alerts and incidents. You will analyze events across endpoints, firewalls, IDS/IPS, cloud services, and identity systems, and document findings in case management systems.

The role emphasizes incident containment, remediation prioritization, and collaboration within a 24x7 cybersecurity operations environment, with onsite work only.

Qualifications

• Experience in cybersecurity operations, security monitoring, incident response, threat detection, security investigations, or related cybersecurity disciplines.
• Experience triaging security alerts and analyzing security events.
• Experience documenting incident investigations and response activities.
• Experience with cybersecurity frameworks, incident response processes, and threat detection methodologies.
• Experience working with SIEM, EDR/XDR, IDS/IPS, firewalls, endpoint security, cloud security, and threat intelligence platforms.
• Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, LogRhythm, or NetWitness.
• Experience with Microsoft Security / Microsoft 365 Defender XDR.
• Experience with EDR solutions such as Microsoft Defender for Endpoint, CrowdStrike, or SentinelOne.
• Knowledge of MITRE ATT&CK, IOCs, IOAs, malware, phishing, and common cyber threats.
• Experience with vulnerability management tools such as Tenable, Qualys, or Rapid7.
• Knowledge of Windows, Linux, networking protocols, Active Directory, Microsoft Entra ID, and cloud environments.
• Experience with query languages such as KQL, SPL, Lucene, or ESQL.
• Experience with scripting languages such as PowerShell, Python, or Bash.
• Knowledge of NIST Cybersecurity Framework, NIST Incident Response guidance, and PICERL.
• Strong analytical, investigative, documentation, communication, and problem-solving skills.
• Ability to distinguish legitimate threats from false positives and make risk-based decisions.
• Ability to work independently and collaboratively within a 24x7 cybersecurity operations environment.

Responsibilities

• Monitor, analyze, and triage cybersecurity alerts from security monitoring and detection platforms.
• Investigate security events and suspicious activity to determine severity, scope, impact, and potential risk.
• Identify, validate, and prioritize potential cybersecurity incidents and eliminate confirmed threats as appropriate.
• Correlate security events from multiple sources, including endpoints, firewalls, IDS/IPS, cloud services, authentication systems, and threat intelligence feeds.
• Analyze indicators of compromise (IOCs), phishing activity, malware detections, suspicious network activity, and anomalous user behavior.
• Document security investigations, findings, and response actions in ticketing and case management systems.
• Support incident containment, eradication, and recovery activities.
• Perform vulnerability assessment reviews and support risk-based remediation prioritization.
• Assist with alert tuning, threat intelligence integration, detection improvements, and false-positive analysis.
• Support the development and maintenance of security procedures, playbooks, workflows, and knowledge base documentation.
• Research emerging cyber threats, attack techniques, tactics, and procedures (TTPs).
• Participate in incident response, escalation, and after-action review activities.
• Maintain accurate investigation documentation, metrics, and technical reports.
• Provide support outside normal business hours during high-priority security incidents as required.

Skills

Cybersecurity operations

Security monitoring

Incident response

Threat detection

Security investigations

SIEM

EDR/XDR

Firewalls

Cloud security

Threat intelligence

MITRE ATT&CK

Vulnerability management

Windows

Linux

Networking

Active Directory

PowerShell

Python

NIST

Tools

Microsoft Sentinel

Splunk

QRadar

ArcSight

LogRhythm

NetWitness

Defender for Endpoint

CrowdStrike

SentinelOne

Job description

ASSYST is seeking a Network Security Analyst in Austin, TX to monitor, triage, and investigate cybersecurity alerts and incidents. You will analyze events across endpoints, firewalls, IDS/IPS, cloud services, and identity systems, and document findings in case management systems.

The role emphasizes incident containment, remediation prioritization, and collaboration within a 24x7 cybersecurity operations environment, with onsite work only.