Cyber Security Analyst

Mid-Level Cyber Defense Analyst

The Mid-Level Cyber Defense Analyst uses defensive measures and information collected from a variety of sources to identify, analyze, and report vulnerabilities and malicious events. This role focuses on maintaining the integrity of our internal and cloud networks by conducting deep-dive analysis of security data, recognizing operational trends, and leading initial incident containment efforts.

Responsibilities:

• Investigate security alerts escalated by SOC Level 1 analysts.
• Perform deeper analysis of suspicious activity across SIEM, EDR, network, identity, cloud, and email security platforms.
• Validate whether security events represent false positives, suspicious behavior, policy violations, or confirmed cybersecurity incidents.
• Correlate events across multiple log sources to identify attack patterns, affected assets, compromised accounts, lateral movement, malware activity, or unauthorized access.
• Determine the scope, severity, business impact, and urgency of security incidents.
• Recommend containment, eradication, and remediation actions to the appropriate technical teams.
• Create and maintain accurate incident timelines, investigation notes, evidence records, and escalation summaries.
• Support phishing investigations, endpoint compromise analysis, suspicious login reviews, malware alerts, brute-force attacks, data exfiltration indicators, and cloud security events.
• Review and improve SOC playbooks, investigation procedures, and escalation criteria.
• Provide technical guidance, coaching, and feedback to SOC Level 1 analysts.
• Identify recurring false positives and recommend tuning improvements for SIEM, EDR, and other detection platforms.
• Participate in post-incident reviews and provide recommendations to improve detection, response, and prevention.
• Support shift handovers by documenting open incidents, pending actions, and important operation contexts.