Security Analyst I [AQ-23372]

Aquent; Houston (TX); On-site; USD 65,000 - 95,000; Full time

Job summary

Aquent partners with a leading organization to safeguard critical infrastructure through a robust cybersecurity platform. You will join a 24/7 Security Operations Center to detect, analyze, and respond to incidents, contributing to resilient operations and continuous protection of digital assets.

Ideal candidates have 2+ years in SOC, an associated degree or equivalent, and active CompTIA Security+. Proficiency with Splunk, Splunk SOAR, Proofpoint, and networking basics is expected, with strong

Qualifications

• Minimum 2 years in a 24/7 SOC environment.
• Active CompTIA Security+ certification required.
• Experience with Splunk, Splunk SOAR, Proofpoint.
• Knowledge of networking fundamentals and log analysis.
• Microsoft and Azure security familiarity.

Responsibilities

• Monitor and analyze security events from SIEM tools (Splunk) and other security tools.
• Perform initial triage and investigate alerts for severity, scope, and impact.
• Analyze logs, network activity, and endpoint data to identify malicious activity.
• Enrich alerts with threat intelligence and asset/user context for decision making.
• Document incidents and actions in case management systems; follow escalation paths.

Job description

Aquent is proud to partner with a leading organization dedicated to delivering essential services, where safeguarding critical infrastructure and data is paramount. This organization is committed to operational excellence and relies on robust cybersecurity measures to ensure continuous, reliable service for its customers. Join their vital cybersecurity team and play a crucial role in protecting their digital landscape, directly contributing to the security and resilience of their operations.

Are you ready to be a frontline defender in the ever-evolving world of cyber threats? We are seeking dynamic individuals to step into a critical role within a 24/7 Security Operations Center (SOC). As a key member of the team, you will be instrumental in the initial detection, analysis, and response to security incidents, making a tangible impact on the organization’s security posture. This is an exciting opportunity for a curious, analytical, and highly motivated professional to contribute to a fast-paced environment, leveraging cutting-edge tools to protect vital assets and ensure operational continuity for countless customers. You will contribute directly to the success of the organization by ensuring the continuous protection of vital digital assets and maintaining the trust of their customers.

What You’ll Be Doing

• Monitor and analyze security events and alerts generated from SIEM platforms, including Splunk, and other critical security tools.
• Perform initial triage and in-depth investigation of alerts to accurately determine their severity, scope, and potential impact on systems and data.
• Analyze logs, network activity, endpoint data, and email security alerts (e.g., Proofpoint) to proactively identify and mitigate malicious activity.
• Enrich security alerts with vital contextual data, including threat intelligence, asset information, and user behavior analytics, to facilitate informed decision-making.
• Follow defined escalation paths to more senior analysts (Tier 2/3) based on the severity, confidence, and impact of detected incidents.
• Document all incidents, findings, and actions taken thoroughly within case management systems, ensuring comprehensive records.
• Execute basic response actions and automated playbooks using SOAR platforms, such as Splunk SOAR, to streamline incident resolution.
• Assist in containment actions for active threats under the expert guidance of senior team members.
• Contribute to 24/7 SOC operations, including participating in shift work (nights, weekends, holidays), ensuring continuous monitoring and robust response capabilities.
• Actively participate in shift handoffs, providing comprehensive updates to maintain seamless situational awareness across the team.
• Stay current on emerging threats, vulnerabilities, and attack techniques to continuously enhance detection and response capabilities.
• Provide valuable feedback for the tuning of detection rules to improve alert fidelity and significantly reduce false positives.

Required Qualifications

• Minimum 2 years of experience in a 24/7 Security Operations Center (SOC) environment.
• An Associate degree in Cybersecurity, Information Technology, or a related field, OR equivalent practical experience in a SOC setting.
• Active CompTIA Security+ Certification is required.
• Demonstrated experience with security tools such as Splunk, Splunk SOAR, and Proofpoint.
• Proven experience in triaging security alerts and diligently following established escalation processes.
• Foundational knowledge of networking fundamentals and log analysis techniques.
• Familiarity with Microsoft and Azure security platforms and services.
• Strong analytical thinking and problem-solving skills to dissect complex security incidents effectively.
• Exceptional attention to detail in monitoring, investigation, and documentation.
• Excellent communication skills, both written and verbal, for effective collaboration and incident reporting.
• Adaptability and resilience to thrive in a fast-paced, dynamic cybersecurity environment.
• A high degree of curiosity and initiative to continuously learn and improve your skills.
• A collaborative spirit, working effectively within a team to achieve common security goals.

Preferred Qualifications

• CompTIA CySA+ certification.
• Splunk Core Certified User certification.
• Microsoft Security certifications (e.g., SC-200, AZ-500).