Security Analyst, Cloud & Incident Response

BCC Software; Town of Pittsford (NY); Híbrido; USD 100 000 - 150 000; Tempo integral

Resumo da oferta

BCC Software is hiring a Security Analyst to strengthen identity security, implement and manage security tools, and lead incident response across our Microsoft-based security stack.

The role requires 5+ years in cybersecurity operations, familiarity with CSF 2.0 and SOC 2 audits, and the ability to work in a fast-paced, cross-functional environment. Occasional travel to data centers and Rochester, NY may be required.

Qualificações

• 5+ years of cybersecurity operations experience or equivalent experience.
• Strong understanding of secure network architecture and networking principles.
• Knowledge of Windows, macOS, and Linux operating systems.
• Hands-on security experience with Microsoft 365 and Microsoft Azure, including Entra ID, Conditional Access, phishing-resistant MFA, PIM, Defender XDR, Microsoft Sentinel, Microsoft Intune security capabilities, Defender for Cloud, and Azure Policy.
• Ability to review the security configuration and risk posture of network infrastructure, including Juniper and Cisco switches and Fortinet firewalls.
• Experience supporting SOC 2 Type II audits, including control validation and evidence collection.
• Familiarity with NIST Cybersecurity Framework (CSF) 2.0 and CIS Controls.
• PowerShell scripting and KQL query skills for security operations, investigation, and automation.
• Ability to respond quickly to critical problems and willingness to participate in an on-call rotation.
• Strong written and verbal communication skills, including the ability to define security SLAs, evaluate evidence, report risk, and communicate requirements to technical and business stakeholders.
• Understanding of adversary tactics and tooling (MITRE ATTACK; e.g., Cobalt Strike and Mimikatz) sufficient to detect, hunt, and validate controls.
• One or more relevant security certifications are preferred, including Microsoft Certified: Security Operations Analyst Associate (SC-200), Azure Security Engineer Associate (AZ-500), Identity and Access Administrator Associate (SC-300), or CISSP.

Responsabilidades

• Strengthen identity security using Microsoft Entra ID, Conditional Access, phishing-resistant MFA, and Privileged Identity Management (PIM).
• Integrate, deploy, support, and continuously improve security tools and the Microsoft security stack, including Defender XDR, Microsoft Sentinel and KQL, and Microsoft Intune security capabilities.
• Oversee the managed detection and response (MDR) provider, including escalations, tuning, and service reviews.
• Own the vulnerability and exposure management program, establish remediation SLAs, verify remediation evidence, and report status, exceptions, and risk trends.
• Lead incident response and serve as the primary security contact during incidents; maintain playbooks, escalation procedures, tabletop exercises, and on-call expectations.
• Establish Azure cloud security guardrails for landing zones and oversee Defender for Cloud, Azure Policy, and related cloud security controls.
• Own data protection controls through Microsoft Purview sensitivity labeling and data loss prevention for customer data and personally identifiable information.
• Enforce the AI Usage Policy and govern risks associated with Microsoft Copilot oversharing, shadow AI, and SaaS discovery.
• Manage third-party and vendor security risk, including due diligence, recurring reviews, evidence collection, and customer security questionnaires.
• Manage security ticket workflows for access reviews and phishing reports; define response SLAs and verify supporting evidence.
• Create and maintain security documentation, including policies, the risk register, incident response records, and audit evidence.
• Align the security program with NIST Cybersecurity Framework (CSF) 2.0, CIS Controls, SOC 2 Type II, USPS licensing security requirements, and cyber insurance attestations.
• Validate ransomware resilience through evidence of immutable backups and recurring recovery testing.
• Manage the security awareness training program and work across teams to reinforce security policies, controls, monitoring, and best practices.
• Provide backup support for network, server, and cloud administration as needed, without assuming primary responsibility for routine administration.
• Assist with security-related budgets and purchases.
• Serve as liaison with security and IT professionals at BlueCrest and Platinum.
• Develop and manage security reports and dashboards for management.

Conhecimentos

Cybersecurity ops

Identity security

Security governance

KQL scripting

PowerShell scripting

Azure security

Communication

Incident response

On-call readiness

Ferramentas

Microsoft Entra ID

Defender XDR

Microsoft Sentinel

KQL

Intune security

Azure Policy

Purview

PIM

Descrição da oferta de emprego

BCC Software is hiring a Security Analyst to strengthen identity security, implement and manage security tools, and lead incident response across our Microsoft-based security stack.

The role requires 5+ years in cybersecurity operations, familiarity with CSF 2.0 and SOC 2 audits, and the ability to work in a fast-paced, cross-functional environment. Occasional travel to data centers and Rochester, NY may be required.