Network Security Analyst (SEIM platform) - 10+ years of experience

Job Title: Network Security Analyst (SEIM platform) - 10+ years of experience

Location: Austin, TX (Onsite) (Local candidates only).

We are currently seeking candidates who meet the following qualifications:

Required Qualifications

• Knowledge of SIEM, SOAR, EDR, XDR, and NDR.
• Experience with security log collection and management.
• Experience with threat intelligence concepts.
• Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting.
• Experience in SIEM platform and architecture support.
• Experience in detection engineering methodology and implementation.
• Hands-on experience with Microsoft Sentinel, including incident management, analytics rules, workbooks, automation, data connectors, and Kusto Query Language.
• Experience using SIEM for log analysis, alert investigation, dashboarding, correlation searches, and security monitoring.
• Experience with NDR for network traffic analysis, packet/session investigation, threat detection, and incident support.
• Experience with EDR tools, including endpoint alert triage, device investigation, advanced hunting, and response actions.
• Working knowledge of network security concepts, including firewalls, IDS/IPS, proxy logs, DNS, VPN, TCP/IP, segmentation, and secure network architecture.
• Ability to analyze complex security events, correlate data across multiple sources, and produce clear written documentation and recommendations.
• Knowledge of security frameworks, standards, and regulatory considerations such as NIST, CIS Controls, HIPAA, and state information security requirements.
• Strong communication, collaboration, problem-solving, and analytical skills.

Preferred Qualifications

• Bachelor s degree in cybersecurity, computer science, information systems, information technology, or a related field. Relevant experience may be considered in place of education where applicable.
• Microsoft security certifications are strongly preferred, such as Microsoft Certified: Security Operations Analyst Associate, Microsoft Certified: Cybersecurity Architect Expert, Microsoft Certified: Azure Security Engineer Associate, or Microsoft 365 Defender-related certifications.
• Additional preferred certifications include CompTIA Security+, CySA+, GIAC security certifications, CISSP, CISM, CISA, Splunk Core Certified Power User, Splunk Enterprise Security Certified Admin, or SentinelOne product certifications.
• Advanced knowledge of SIEM, SOAR, EDR, XDR, NDR, log management, and threat intelligence concepts.
• Advanced experience with security log collection and management.
• Advanced knowledge of threat intelligence concepts.
• Advanced skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting.
• Advanced experience in SIEM platform and architecture support.
• Advanced experience in detection engineering methodology and implementation.

Key Responsibilities

• Monitor security alerts, logs, network events, endpoint telemetry, and threat intelligence feeds.
• Analyze suspicious activity, anomalous network behavior, malware indicators, endpoint detections, and SIEM correlation events to determine scope, impact, and required response actions.
• Perform incident triage, investigation, escalation, containment coordination, and documentation in alignment with HHSC security operations procedures.
• Develop, tune, and maintain detection rules, dashboards, alerts, playbooks, and queries to improve visibility across network, endpoint, identity, and cloud environments.
• Support threat hunting activities using KQL, SPL, packet/session analysis, endpoint telemetry, and other investigative techniques.
• Assist with vulnerability, risk, and control assessments for network security infrastructure and enterprise information systems.
• Document findings, prepare incident reports, track corrective actions, and communicate technical information to security leadership and business stakeholders.
• Collaborate with network, infrastructure, cloud, endpoint, and application teams to validate security events and implement risk mitigation measures.
• Maintain awareness of emerging cyber threats, attack techniques, indicators of compromise, and security best practices relevant to healthcare and public-sector environments.
• Support compliance, audit, and reporting activities by providing evidence, metrics, and security operations documentation as requested.
• Participate in incident response, escalation, and after-action review activities as needed.
• Support enterprise security monitoring for systems that process, store, or transmit sensitive information.
• Follow HHSC policies, procedures, standards, and applicable state and federal security requirements.
• Maintain accurate operational documentation, investigation notes, metrics, and leadership-ready summaries.
• May be required to provide support outside normal business hours during high-priority security incidents or planned maintenance activities.
  
  
  
  
  
  
  
  
  If you meet these qualifications, please submit your application via link provided in Linkedin
  Kindly do not call the general line to submit your application.