Security Analyst (Remote)

RecruiterForge; United States; On-site; USD 90,000 - 130,000; Full time

Job summary

RecruiterForge is seeking a Security Analyst II to monitor, investigate, and respond to security events across customer environments. You will work with customers and internal teams on incident response, detection improvements, and security operations.

Responsibilities include triage, containment support, telemetry review, and clear customer communications. Strong knowledge of SIEM, EDR tools, cloud security, and MITRE ATT&CK is expected.

Qualifications

• Experience in a SOC, MSSP, or MDR environment.
• Proficiency with SIEM/log-management platforms (Splunk/Elastic/Microsoft Sentinel/Google Security).
• Experience with EDR tools (CrowdStrike/Defender/SentinelOne).
• Cloud experience (AWS/Azure/GCP).
• Experience with Microsoft 365 and Entra ID/Azure AD.
• Automation skills using PowerShell or similar.
• Familiarity with SOAR platforms (Cortex XSOAR, Splunk SOAR).
• Knowledge of MITRE ATT&CK framework.
• Strong communication and customer-focused approach.

Responsibilities

• Monitor security alerts across customer environments and internal platforms.
• Analyze and investigate suspicious activity across endpoints, networks, and cloud services.
• Perform initial triage to gauge incident severity and scope.
• Escalate high-risk incidents to incident response teams.
• Assist in containment and remediation activities during incidents.
• Review telemetry and logs to identify anomalies and threats.
• Document investigations and customer communications clearly.
• Contribute to detection, automation, and process improvements.

Skills

SOC experience

SIEM/log management

EDR tools

Cloud platforms

Microsoft 365

PowerShell

SOAR

Incident response

MITRE ATT&CK

Network security

Communication

Tools

Splunk

Elastic Stack

Microsoft Sentinel

Google Cloud Operations

CrowdStrike

Microsoft Defender

SentinelOne

Cortex XSOAR

Splunk SOAR

Job description

The Security Analyst II monitors, investigates, and responds to security events across customer environments. Working with customers and internal security teams, this role supports incident response, investigates threats, and improves detection capabilities and security operations.

Core responsibilities

• Monitor security alerts and events across the security platform and customer environments.
• Analyze and investigate suspicious activity across endpoints, networks, servers, identity systems, cloud environments, and security technologies.
• Perform initial triage to determine the severity, scope, and potential impact of security incidents.
• Escalate confirmed or high-risk incidents to incident response teams or senior security specialists.
• Participate in incident response, including containment and remediation activities.
• Review security telemetry, logs, and alerts to identify malicious or abnormal behavior.
• Document investigations, findings, actions taken, and customer communications accurately.
• Complete daily operational security tasks in line with established processes and service expectations.
• Communicate security findings and recommended actions to customers and internal stakeholders.
• Identify improvements to detection, automation, operational processes, and platform effectiveness.
• Collaborate with managed detection and response, threat hunting, incident response, engineering, and customer success teams.

Required experience and skills

• Experience in a Security Operations Center, Managed Security Service Provider, or Managed Detection and Response environment.
• Experience with SIEM and log-management platforms such as Splunk, Elastic Stack, Microsoft Sentinel, or Google Security Operations.
• Experience with endpoint detection and response tools such as CrowdStrike, Microsoft Defender, or SentinelOne.
• Experience with cloud environments and technologies, including AWS, Microsoft Azure, and Google Cloud Platform.
• Experience supporting Microsoft 365, Entra ID/Azure AD, Proofpoint, or other enterprise security platforms.
• Advanced system administration experience using Windows PowerShell, Ansible, SaltStack, Chef, Puppet, or similar technologies.
• Experience with SOAR platforms such as Cortex XSOAR, Splunk SOAR, or comparable tools.
• Familiarity with incident response, threat hunting, digital forensics, or malware analysis.
• Understanding of the MITRE ATT&CK framework and common adversary behaviors.
• Strong understanding of how networks, endpoints, servers, identity systems, and cloud environments interact.
• Critical thinking, technical curiosity, clear communication, and a customer-focused approach.