Cybersecurity Investigator

Company DescriptionFor over 100 years, BlueScope continues to build on our reputation of quality brands and products, leading technology and a customer-first spirit. Through our global brands, we are one of the largest manufacturers of building solutions in the world. Our diverse, bright and inspired workforce is committed to bettering the communities we serve through breakthrough thinking and innovations. Your goals, ideas and perspective can help shape our future – we look forward to hearing them! The Cybersecurity Investigator plays a critical role in protecting BlueScope North America's information assets by monitoring, investigating, containing, and responding to cybersecurity threats. The position serves as an experienced Security Operations Center analyst and escalation resource for complex security events affecting enterprise, cloud, identity, email, endpoint, network, and operational technology environments.The Cybersecurity Investigator applies strong analytical judgment, technical investigation skills, and incident response experience to determine the scope, impact, and root cause of suspicious activity. The role collaborates with regional and global technology teams, supports continuous improvement of detection and response capabilities, and communicates findings clearly to technical and non-technical stakeholders.Key Focus AreasSecurity Monitoring & InvestigationsMonitor and investigate security events and alerts from SIEM, endpoint detection and response, identity, email, cloud, network, and other cybersecurity technologies.Perform advanced triage and analysis of suspicious activity, potential policy violations, and confirmed security incidents.Analyze endpoint, identity, application, cloud, and network telemetry to determine incident scope, impact, and likely root cause.Correlate security telemetry, threat intelligence, and contextual information to distinguish malicious activity from expected business operations.Document investigative actions, evidence, findings, and conclusions in a clear and repeatable manner.Serve as an escalation point for complex or high-risk investigations and provide guidance to less-experienced analysts.Incident ResponseCoordinate and perform incident response activities, including identification, containment, eradication, recovery, and post-incident review.Investigate phishing, malware, ransomware, account compromise, insider threat, unauthorized access, data loss, and other cybersecurity events.Collect and preserve relevant evidence in accordance with established procedures and legal or regulatory requirements.Develop, maintain, and improve incident response playbooks, investigation procedures, and escalation workflows.Coordinate remediation activities with infrastructure, identity, application, cloud, networking, legal, human resources, and business stakeholders.Provide timely status updates and clearly communicate incident risk, business impact, decisions, and required actions.Threat Detection & Threat HuntingConduct proactive threat hunting to identify suspicious behaviors or indicators that may not generate traditional security alerts.Use the MITRE ATT&CK framework and threat intelligence to evaluate adversary tactics, techniques, and procedures.Recommend and help develop detection use cases, correlation rules, hunting queries, dashboards, and investigation workflows.Tune detections to improve fidelity, reduce unnecessary alert volume, and strengthen coverage of relevant threats.Validate security controls and detections through investigative feedback, testing, and lessons learned from incidents.Security Operations ImprovementIdentify recurring investigation patterns and recommend opportunities for automation, orchestration, and process improvement.Develop and maintain operational metrics, case reporting, and trend analysis for security monitoring and incident response activities.Contribute to security operations procedures, knowledge articles, and analyst training materials.Support major incident exercises, tabletop exercises, and continuous improvement activities.Assist with cybersecurity assessments, audit requests, and risk-reduction initiatives as needed.Collaboration & CommunicationCollaborate with global and regional security, infrastructure, networking, identity, application, cloud, and operational technology teams.Prepare clear investigation reports, incident summaries, and executive-ready communications appropriate to the audience.Share investigative knowledge, mentor developing analysts, and promote consistent security operations practices.Build effective relationships with internal stakeholders and external security service providers.Maintain awareness of emerging threats, attacker behaviors, defensive technologies, and investigative techniques.Foundational ExperienceRequired Qualifications & Experience: To be considered for this position, you must possess the following qualifications:Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline; or equivalent education and practical experience.4+ years of experience in cybersecurity, security operations, incident response, threat hunting, digital forensics, or cyber investigations.Experience working in a Security Operations Center or comparable security monitoring and response environment.Hands-on experience investigating alerts and incidents using SIEM, endpoint detection and response, identity, email, cloud, and network security technologies.Strong knowledge of Windows, Active Directory, Microsoft Entra ID, Microsoft 365, networking, authentication, and security event analysis.Experience investigating phishing, malware, ransomware, account compromise, insider threat, unauthorized access, or data protection incidents.Knowledge of incident response methodologies, evidence handling, threat intelligence, and the MITRE ATT&CK framework.Ability to analyze complex technical information, reach defensible conclusions, and communicate findings to technical and non-technical stakeholders.Strong written communication, documentation, organizational, troubleshooting, and problem-solving skills.Ability to participate in an on-call or after-hours response rotation when required for critical cybersecurity incidents.Desired Qualifications: To be considered an ideal candidate, you should possess some or all of the following qualifications:Certifications such as GCIH, GCIA, GCFA, CySA+, SC-200, CISSP, or comparable security credentials.Experience with SIEAM, XDR, SASE, or similar security operations platforms.Experience conducting cloud security investigations in Microsoft Azure or other cloud environments.Familiarity with digital forensics, memory or disk analysis, malware analysis, and evidence preservation practices.Experience creating detection rules, threat hunting queries, security automation, or orchestration workflows.Experience supporting manufacturing, industrial, critical infrastructure, or operational technology environments.Experience coordinating investigations with managed security service providers, legal teams, human resources, or law enforcement.Skills and AbilitiesAt BlueScope we believe in investing in our employees through our Leading at BlueScope Attributes. Below are attributes that will be key to your success at BlueScope:Driver of Future Readiness – Takes a strategic orientation to shape the direction; ensures impact-driven strategy; is a thought leader in their own way.Creative Problem Solver – Seeks and leverages diverse perspectives; fosters innovation and creative solutions; finds smarter solutions and uncovers value.Change Facilitator – Models continual improvement; seizes opportunities to adapt; is optimistic about change and motivates others in the change journey.Results Achiever – Delivers against continually higher levels of performance; strives for constant improvement; looks for ways to work smarter; pushes forward despite ambiguity.Driver of Commercial Success – Thinks and acts in the commercial interest of BlueScope; makes sound decisions to improve the balance sheet; unlocks efficiencies and opportunities for commercial advantage.Builder of Customer Value – Seeks to know customers deeply; walks in the customer's shoes; constantly thinks about adding value to customer relationships.Collaborative Partner – Seeks to understand; shares knowledge; builds and uses diverse networks for greater impact; uses a range of skills and approaches to influence others.Capability Builder – Prioritises learning and development and stretches outside comfort zones; invests in strengthening capability; makes judgements that allow others to achieve their full potential.Work EnvironmentThis position is part of BlueScope North America and supports cybersecurity monitoring, investigations, and incident response activities.The role collaborates with stakeholders across multiple BlueScope businesses, regions, and time zones.Participation in an on-call rotation or work outside normal business hours may be required to support critical cybersecurity incidents.BlueScope embraces flexible working arrangements where possible and mutually agreed.Additional InformationThe preceding job responsibilities and tasks were designed to indicate the general nature and level of work performed by associates in this job. It is not designed to contain or be interpreted as a comprehensive inventory of all job duties and responsibilities required of associates assigned to this job. Associates may be required to perform other duties as assigned. Additional job competencies, individual goals, and performance measurements are set at the department level.The benefits are just as rewarding as the work at BlueScope. To support our goal, we offer a total compensation plan and an outstanding benefits package that includes health insurance, life insurance, short and long term disability, paid time off, and retirement. EEO: Employer/M/F/Disabled/Protected VeteranBlueScope is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, age, status, as a protected veteran, among other things, or status as a qualified individual with disability. SummaryLocation: KS-Remote; MO-Kansas CityType: Full time