Security Operations Analyst: Incident Response & IAM

Remote; San Francisco (CA); Remote; USD 90,000 - 150,000; Full time

Job summary

Appen is seeking an IT Security Analyst to protect our information assets by operating and improving security controls. You will own security operations across Microsoft Defender, lead incident response, and maintain ISO 27001 documentation.

You’ll drive IAM, access reviews, PAM, patch management, and cost optimisation while coordinating with stakeholders across the organization to ensure compliance and resilient security operations.

Qualifications

• 1-3 years' experience in a security operations or security analyst role.
• Hands-on experience with Microsoft Defender XDR, Sentinel and Entra ID.
• Experience leading security incidents and producing incident reports.
• Working knowledge of ISO 27001 controls and audit processes.
• Experience with IAM, access reviews, PAM and patch management.
• Proficiency with KQL and PowerShell or Python.
• Strong communication skills with technical and non-technical stakeholders.

Responsibilities

• SOC & alert management across Defender XDR and Sentinel; tune detections and reduce false positives.
• Lead end-to-end incident response; maintain incident response plan and playbooks.
• Maintain ISMS policies, risk register and audit evidence; support audits.
• Administer Entra ID (Conditional Access, MFA); run quarterly access reviews and enforce least privilege.
• Operate Privileged Access Management (PAM), including PIM and break-glass accounts.
• Own vulnerability remediation and monthly patch cycles; report SLA compliance.
• Manage security licences and Sentinel log ingestion to optimise cost.

Skills

Microsoft Defender XDR

Microsoft Defender

Microsoft Sentinel

Entra ID

Incident response

IAM & access reviews

PAM

KQL

PowerShell

Python

Communication

Tools

ISO 27001 controls

Job description

Appen is seeking an IT Security Analyst to protect our information assets by operating and improving security controls. You will own security operations across Microsoft Defender, lead incident response, and maintain ISO 27001 documentation.

You’ll drive IAM, access reviews, PAM, patch management, and cost optimisation while coordinating with stakeholders across the organization to ensure compliance and resilient security operations.