Threat Detection & Response Analyst

LIVE | WORK

Santa Ana (CA)

Hybrid

USD 100,000 - 110,000

Full time

2 days ago

Be an early applicant

Application generator

A complete application in a minute — tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

LIVE | WORK in Santa Ana, CA is seeking an experienced Cybersecurity Analyst to support the day‑to‑day operation, monitoring, and continuous improvement of our cybersecurity program in a hybrid environment. The role covers protecting infrastructure, networks, endpoints, cloud services, and data, working with cross‑functional teams to detect, investigate, remediate, and strengthen defenses.

Responsibilities include incident response exercises, vulnerability management, identities, MFA, SIEM,

Qualifications

4+ years of progressive IT experience across systems administration, networking, infrastructure, and/or cybersecurity, with increasing responsibility.
2+ years of hands‑on cybersecurity or security‑focused responsibilities.
Strong working knowledge of enterprise networking concepts including TCP/IP, DNS, DHCP, VLANs, routing, switching, VPNs, firewalls, and network segmentation.
Strong working knowledge of Windows Server, Active Directory, Group Policy, and enterprise identity environments.
Experience administering or securing Microsoft 365 and Entra ID environments.
Experience with endpoint security, operating system hardening, patching, and vulnerability remediation.
Experience investigating security alerts, suspicious activity, or cybersecurity incidents.
Understanding of authentication, authorization, privileged access, MFA, Conditional Access, and least‑privilege principles.

Responsibilities

Monitor, investigate, and triage security alerts, suspicious activity, and potential cybersecurity incidents.
Coordinate containment, remediation, recovery, and escalation activities based on incident scope and impact.
Support incident response exercises, post‑incident reviews, and improvements to security detection and response capabilities.
Coordinate vulnerability scanning, prioritization, remediation, validation, patch management across servers, endpoints, networks, and platforms.
Support identity and access security, including MFA, Conditional Access, SSO, privileged access reviews, and least‑privilege initiatives.
Assist with security configuration and monitoring across Microsoft 365, Entra ID, endpoints, and related cloud services.
Investigate phishing, suspicious email, malicious attachments, account compromise activity, and other threats.
Support cybersecurity risk assessments, policies, standards, audits, and third‑party reviews.