Senior SOC Security Analyst - Automation & Forensics

NPAworldwide; City of Syracuse (NY); Presencial; USD 90 000 - 150 000; Tempo integral

Resumo da oferta

NPAworldwide is seeking an experienced Information Security Analyst to support security operations, incident response, vulnerability management, and security automation across a complex enterprise.

You will operate in a hands-on SOC role, investigating alerts, enhancing detection, and guiding junior analysts while developing automation using Python and PowerShell in Windows and Linux environments.

Qualificações

• 5+ years of professional Information Technology experience.
• 2+ years of Information Security or Cybersecurity experience.
• 2+ years of hands-on SOC operations experience involving IDS/EDR alert triage, log analysis, and network traffic interpretation.
• 2+ years of experience with SIEM or log-analysis technologies such as Splunk, Kibana, Elastic/OpenSearch, or Microsoft Sentinel.
• 2+ years of experience with Microsoft Defender for Endpoint, including alert triage, investigation, and response.
• 2+ years of Python 3 scripting experience supporting security automation, analysis, or SOC workflows.
• 2+ years of experience with firewall administration and network security fundamentals.
• 1+ years of experience with Windows and Active Directory administration and security.
• 1+ years of experience analyzing endpoint and Windows security logs.
• 1+ years of experience with PowerShell scripting and Group Policy.
• 1+ years of Linux system administration experience.
• 1+ years of first‑responder‑level digital forensic experience.
• 1+ years of experience using AI‑assisted security technologies, including AI‑enabled SIEM, investigation, automation, or productivity capabilities.
• Experience working in a production SOC or comparable security operations environment investigating active security alerts and incidents is strongly preferred.
• Experience mentoring or providing technical guidance to junior security analysts is preferred.

Responsabilidades

• Monitor telemetry for potential security threats.
• Investigate IDS/IPS and EDR alerts, security logs, system events, and network traffic to identify suspicious activity.
• Perform second-level analysis of escalated alerts, determine severity, and document findings.
• Use SIEM and log-analysis platforms like Splunk, Elastic/OpenSearch, Kibana, and Microsoft Sentinel to investigate events.
• Operate, tune, and propose improvements to SIEM/EDR/endpoint security.
• Support Microsoft Defender and related Microsoft security technologies for alert investigation and response.
• Develop threat-hunting and detection strategies based on emerging threats.
• Identify and integrate additional security data sources to improve monitoring.
• Develop Python 3 and PowerShell scripts to automate detection, enrichment, and response.
• Support firewall administration, including security policy enforcement.
• Incorporate AI-assisted security capabilities into workflows.
• Serve as a technical first responder for cybersecurity incidents.
• Perform endpoint/identity/network/log/system analysis to determine incident scope.
• Support containment, eradication, and recovery activities.
• Conduct first-responder-level digital forensic analysis and breach assessment.
• Prepare incident documentation for leadership.
• Configure and review vulnerability scans and analyze weaknesses.
• Prioritize vulnerabilities by severity and business impact.
• Coordinate remediation with infrastructure and app owners.
• Validate remediation and patching effectiveness.
• Mentor junior SOC analysts.
• Help onboard and train day-to-day security staff.
• Develop SOC runbooks and escalation guidelines.

Conhecimentos

SOC operations

Python scripting

PowerShell scripting

Windows security

Linux security

Firewall administration

Threat hunting

Incident response

KQL

Cloud security

AI security tools

SIEM

Formação académica

Bachelor's in Cybersecurity/related

Ferramentas

Splunk

Kibana

Elastic/OpenSearch

Microsoft Sentinel

Defender for Endpoint

PowerShell

Python

Windows AD

Linux

Descrição da oferta de emprego

NPAworldwide is seeking an experienced Information Security Analyst to support security operations, incident response, vulnerability management, and security automation across a complex enterprise.

You will operate in a hands-on SOC role, investigating alerts, enhancing detection, and guiding junior analysts while developing automation using Python and PowerShell in Windows and Linux environments.