Security Analyst

KJIT Solutions Inc; Wilmington (DE); Remote; USD 120,000 - 180,000; Full time

Job summary

KJIT Solutions Inc. is seeking an Incident Response Contractor to augment a Security Operations team. You will investigate incidents end-to-end, scope threats, contain and remediate across endpoints, identity, email, network, and cloud environments.

Work with Security Operations, Security Engineering, and other technical teams to drive incidents from triage to closure. Remote role, candidates located in New England preferred; H1B/H4 visa support may be considered.

Qualifications

• Hands-on incident response, DFIR, SOC operations, or threat detection and investigation.
• Experience using an enterprise EDR platform to investigate and respond to security incidents.
• Experience using a SIEM or security analytics platform to correlate events and investigate suspicious activity.
• Experience with incident triage, scoping, containment, remediation, and technical documentation.
• Strong analytical, troubleshooting, and communication skills.
• Ability to work independently while collaborating with internal technical teams and external security providers.

Responsibilities

• Triage and investigate security alerts across endpoint, identity, email, network, and cloud environments.
• Scope incidents, assess severity and business impact, and coordinate containment/remediation actions.
• Conduct endpoint investigations and containment using CrowdStrike Falcon or comparable EDR.
• Correlate security events using Splunk or SIEM platforms.
• Collaborate with MDR providers to investigate escalations and coordinate response activities.
• Investigate phishing and email threats using Proofpoint and telemetry.
• Use ThreatLocker telemetry to investigate endpoint activity and potential compromise.
• Analyze network activity using telemetry from firewalls and security platforms.
• Support identity investigations involving Microsoft identity technologies and relevant tools.
• Develop incident timelines and document findings and actions.

Skills

Incident response

Digital forensics

SOC operations

EDR tooling

SIEM (Splunk)

Threat hunting

Technical documentation

Communication

Independent work

Tools

CrowdStrike Falcon

Splunk

Proofpoint

ThreatLocker

ReliaQuest GreyMatter

Job description

Role

Incident Response / Security Analysts

Location

Remote, candidates must be located and working in New England (MA, NH, ME, RI)

Visa

H1B and H4

Position Summary

The Incident Response Contractor will augment the Security Operations team's incident response capabilities by providing hands-on investigation, incident scoping, containment, and remediation support across the enterprise.

This role will increase response capacity, reduce the time required to investigate and contain security incidents, and improve the team's ability to manage concurrent investigations. The contractor will work closely with Security Operations, Security Engineering, and other technical teams to drive incidents from initial triage through containment, remediation, and closure.

Key Responsibilities

• Triage and investigate security alerts and suspected incidents across endpoint, identity, email, network, and cloud environments.
• Scope incidents, assess severity and business impact, identify affected assets and accounts, and coordinate appropriate containment and remediation actions.
• Conduct endpoint investigations and containment using CrowdStrike Falcon or comparable EDR technology, including analysis of endpoint telemetry, suspicious processes, persistence mechanisms, and indicators of compromise.
• Correlate security events and investigate suspicious activity using Splunk or comparable SIEM and security analytics platforms.
• Collaborate with ReliaQuest GreyMatter and the managed detection and response function to investigate escalations, validate findings, and coordinate response activities.
• Investigate phishing, malicious email, and related threats using Proofpoint and available email-security telemetry.
• Use ThreatLocker telemetry to investigate suspicious application execution, unauthorized activity, and potential endpoint compromise.
• Analyze network-related activity using available telemetry from Palo Alto Networks, Check Point, Cisco SSE/Umbrella, Cloudflare, Vectra AI, and comparable technologies, as applicable.
• Support identity-related investigations involving Microsoft identity technologies, CyberArk, Entro, Duo, and CrowdStrike identity capabilities, as applicable.
• Develop incident timelines, correlate indicators of compromise, determine potential attack paths, and document investigative findings.
• Coordinate containment and remediation with Security Engineering, Infrastructure, Identity and Access Management (IAM), Network Engineering, and other stakeholders.
• Validate remediation effectiveness and identify outstanding risks before incident closure.
• Participate in threat hunting, post-incident reviews, detection tuning, and incident response playbook improvements.
• Maintain clear incident records documenting findings, decisions, actions taken, and follow-up requirements.

Qualifications

Required

• Hands-on experience in incident response, digital forensics and incident response (DFIR), SOC operations, or threat detection and investigation.
• Experience using an enterprise EDR platform to investigate and respond to security incidents.
• Experience using a SIEM or security analytics platform to correlate events and investigate suspicious activity.
• Experience with incident triage, scoping, containment, remediation, and technical documentation.
• Strong analytical, troubleshooting, and communication skills.
• Ability to work independently while collaborating effectively with internal technical teams and external security providers.

Preferred

• Hands-on experience with CrowdStrike Falcon and Splunk.
• Familiarity with ReliaQuest GreyMatter or another managed detection and response (MDR) platform.
• Experience with Proofpoint or comparable email-security technologies.
• Experience investigating identity compromise, phishing, endpoint compromise, network intrusions, or cloud security incidents.
• Familiarity with ThreatLocker, network detection and response tools, and enterprise identity security technologies.