Network Security Analyst

The Network Security Analyst 2 is responsible for monitoring, analyzing, and responding to cybersecurity threats using advanced tools and methodologies. This role involves managing security incidents, performing threat detection and investigation, and supporting enterprise security operations to protect sensitive information and maintain network integrity. Responsibilities:

• Manage and respond to security incidents using Microsoft Sentinel and other SIEM platforms.
• Create and maintain analytics rules, dashboards, workbooks, and automation workflows.
• Analyze network traffic and endpoint data using NDR and EDR tools to detect threats and support investigations.
• Correlate security event data from multiple sources and produce clear documentation and recommendations.
• Participate in incident response, escalation, and after-action reviews.
• Support enterprise security monitoring for systems handling sensitive information.
• Maintain accurate operational documentation, investigation notes, metrics, and summaries for leadership.
• Follow organizational policies, procedures, and applicable state and federal security requirements.
• Provide support during high-priority security incidents or planned maintenance outside normal business hours as needed.

• Minimum of seven years of experience in cybersecurity, network security, security operations, incident response, or related fields.
• Hands-on experience with Microsoft Sentinel, including incident management, analytics rules, workbooks, automation, data connectors, and Kusto Query Language (KQL).
• Experience using SIEM for log analysis, alert investigation, dashboarding, correlation searches, and security monitoring.
• Experience with Network Detection and Response (NDR) for network traffic analysis and threat detection.
• Experience with Endpoint Detection and Response (EDR) tools for alert triage, device investigation, and advanced hunting.
• Working knowledge of network security concepts such as firewalls, IDS/IPS, proxy logs, DNS, VPN, TCP/IP, segmentation, and secure network architecture.
• Ability to analyze complex security events and correlate data across multiple sources.
• Knowledge of security frameworks and regulatory requirements such as NIST, CIS Controls, HIPAA, and state information security standards.
• Strong communication, collaboration, problem-solving, and analytical skills.

• Bachelor s degree in cybersecurity, computer science, information systems, information technology, or related field (relevant experience may substitute).
• Microsoft security certifications such as Security Operations Analyst Associate, Cybersecurity Architect Expert, Azure Security Engineer Associate, or Microsoft 365 Defender-related certifications.
• Additional certifications including CompTIA Security+, CySA+, GIAC security certifications, CISSP, CISM, CISA, Splunk Core Certified Power User, Splunk Enterprise Security Certified Admin, or SentinelOne product certifications.
• Knowledge and skills in SOAR, XDR, log management, threat intelligence, and writing/interpreting security queries using KQL and SPL.
• Experience in detection engineering methodology and implementation.

• May require support outside normal business hours during high-priority security incidents or planned maintenance.
• Must adhere to strict organizational policies, procedures, and compliance standards.
• Work involves handling sensitive and confidential information requiring discretion and professionalism.

• Standard work schedule with potential on-call or after-hours support during critical security events.
• Ability to work independently and collaboratively in a dynamic security operations environment with shifting priorities.