Security Operations Specialist: Incident Response & MDR

ITA Group, Inc.; West Des Moines (IA); On-site; USD 90,000 - 120,000; Full time

Job summary

ITA Group, Inc. is seeking an Information Security Administrator to protect our systems, networks, endpoints, and data. You will monitor MDR/SIEM, investigate alerts, and partner with internal teams and an MDR provider to drive mature security operations.

You will validate investigations, tune detections, and participate in containment, remediation, and post-incident reviews with cross-functional teams.

Qualifications

• Associate or bachelor's degree in cybersecurity, information security, information technology, computer science, networking, or a related field; equivalent professional experience may be considered.
• Three to five years of combined experience in information technology, information security, security operations, systems administration, network support, cloud operations, or a related technical discipline.
• At least one to two years of direct experience performing security monitoring, alert triage, incident investigation, vulnerability management, or security-platform administration.
• Prior technical experience in a help desk, desktop support, network operations, systems administration, cloud support, SOC, MDR, MSSP, or similar environment.
• Current CompTIA Security+ or CySA+ certification. Equivalent or more advanced security certifications may be considered when supported by relevant practical experience.
• Working knowledge of security operations, SOC processes, alert triage, incident response, log analysis, and event correlation.
• Ability to independently assess whether activity is legitimate, suspicious, or malicious and to collect and document supporting evidence.
• Applied understanding of the OSI model, TCP/IP, DNS, HTTP/HTTPS, TLS, common ports and protocols, routing, VPNs, firewalls, and network traffic flows.
• Familiarity with endpoint security, secure web gateways/proxies, SIEM, CSPM, CASB, DLP, vulnerability scanning, cloud security, identity security, and application-security testing.
• Familiarity with Microsoft 365, Microsoft Entra ID, Microsoft Azure, AWS, authentication, authorization, multifactor authentication, and privileged access concepts.
• Strong customer service, troubleshooting, analytical, written, verbal, and cross-functional collaboration skills; ability to handle sensitive information appropriately.
• Ability to listen, understand and respond to external and internal customers’ needs in a timely manner; customer service experience in a service-related industry preferred.
• Ability to work the time necessary to complete projects and/or meet deadlines.

Responsibilities

• Monitor and investigate alerts from MDR/SIEM, EDR/XDR, identity, endpoint, network, cloud, email, proxy, CASB, DLP, and vulnerability platforms.
• Perform initial and intermediate triage to determine credibility, scope, severity, and business impact; document findings and recommended actions.
• Validate MDR investigations, severity assignments, and recommended response actions; independently investigate when evidence is incomplete, inconsistent, or high risk.
• Partner with the MDR to tune detections, reduce false positives, improve escalation criteria, and mature joint incident-response playbooks and operating procedures.
• Participate in containment, eradication, recovery, post-incident review, and root-cause analysis activities.
• Coordinate investigations and remediation with infrastructure, networking, cloud, application, Service Desk, and third-party teams.

Skills

Security operations

Incident response

MDR collaboration

SIEM

Cloud security

Identity security

Networking basics

PowerShell

Python

KQL

SQL

Education

Bachelor's degree in cybersecurity or related field

Associate degree acceptable with experience

Tools

MDR/SIEM tooling

EDR/XDR

CASB

Job description

ITA Group, Inc. is seeking an Information Security Administrator to protect our systems, networks, endpoints, and data. You will monitor MDR/SIEM, investigate alerts, and partner with internal teams and an MDR provider to drive mature security operations.

You will validate investigations, tune detections, and participate in containment, remediation, and post-incident reviews with cross-functional teams.