Cybersecurity Analyst

OVERVIEWSupport the day-to-day operation of Santikos’ cybersecurity program by monitoring security events, investigating alerts, managing vulnerabilities, supporting identity and access controls, and helping protect systems and data across corporate and theater environments. Play a hands-on role in protecting a multi-location organization while building broad cybersecurity experience across cloud, identity, endpoints, networks, business applications, incident response, vulnerability management, and enterprise security governance. Work closely with the CIO, IT Infrastructure & Operations Manager, Cloud/POS team, support staff, and external security partners to identify risk, coordinate remediation, support security incidents, and maintain evidence for security and compliance requirements.ROLES & RESPONSIBILITIESMonitor security alerts, logs, and telemetry from endpoint, identity, cloud, email, network, and other security platforms; investigate suspicious activity and escalate incidents as appropriatePerform initial triage and analysis of potential security incidents, document findings, preserve relevant evidence, and support containment, remediation, recovery, and post-incident follow-up activitiesCoordinate vulnerability management activities, including reviewing scan results, validating findings, prioritizing risk, assigning remediation actions, tracking progress, and verifying closureTake ownership of assigned security findings from initial validation through remediation and closure, coordinating with system owners and vendors as needed rather than functioning solely as an alert-monitoring or escalation resourcePerform recurring reviews of user access, privileged accounts, administrative roles, service accounts, MFA, conditional access, and other identity controls in Microsoft 365, Entra ID, Azure, and related systemsSupport privileged-access governance by helping ensure administrative access is appropriately assigned, reviewed, documented, and removed when no longer requiredAssist with security configuration reviews and hardening efforts across endpoints, servers, cloud services, Microsoft 365, network devices, and business applicationsSupport phishing prevention and response, including investigation of suspicious messages, malicious links or attachments, compromised accounts, credential exposure, and user-reported security concernsAssist with security awareness and training activities, including phishing simulations, employee communications, targeted education, and follow-up for identified risksMaintain and improve security documentation, including incident records, procedures, standards, control evidence, risk items, remediation trackers, and technical security configurationsSupport PCI DSS and other applicable security or compliance activities by gathering evidence, coordinating control-owner responses, tracking remediation items, and maintaining support documentationWork with the IT Infrastructure & Operations Manager, Cloud/POS team, and support staff to ensure identified vulnerabilities, insecure configurations, and security findings are remediated within appropriate timeframesSupport endpoint, email, identity, cloud, network, and web-security technologies used by Santikos and coordinate technical escalations with vendors when specialized support is requiredAssist with implementation and ongoing improvement of security controls, including endpoint protection, email security, web filtering, logging, monitoring, MFA, conditional access, privileged identity management, and related safeguardsReview security advisories, threat intelligence, vendor notices, and emerging vulnerabilities to determine potential impact to Santikos systems and recommend practical response actionsSupport onboarding, role changes, and employee separations by validating access-control requirements and assisting with rapid revocation of privileged or sensitive access when neededAssist with periodic testing and validation of security controls, including account reviews, vulnerability scans, recovery evidence, logging, alerting, and other operational security checksOwn the internal remediation lifecycle for findings identified through independent security assessments, vulnerability scans, audits, penetration testing, and other security reviews; coordinate responsible system owners, establish target dates, track remediation through completion, maintain closure evidence, and escalate overdue or unresolved risks to the CIOServe as the primary Santikos operational liaison for the independent cybersecurity assurance program and other external security assessments; provide requested evidence, respond to technical questions, coordinate internal owners, and support validation activities while preserving the independence of the assessorSupport cyber-insurance, audit, and risk-management requests by helping maintain accurate technical evidence and status informationParticipate in security-related projects and technology initiatives to ensure appropriate controls are considered during planning, implementation, and change activitiesIdentify opportunities to automate security monitoring, evidence collection, reporting, and repetitive administrative tasksCommunicate security findings, risks, and recommended actions clearly to technical staff, business stakeholders, and leadershipMaintain confidentiality and use elevated or sensitive system access only for authorized business purposes and in accordance with Santikos policiesPerform other cybersecurity and technology-risk duties as assignedEDUCATION & EXPERIENCE REQUIREMENTS:Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related field preferred; equivalent combination of relevant education, technical training, certifications, and experience will be consideredMinimum of 3 years of progressive experience in cybersecurity, information security, systems administration, network security, security operations, or a closely related technical roleRelevant certifications, such as CompTIA Security+, CySA+, Microsoft Security certifications, GIAC, or equivalent industry certifications are preferredDemonstrated hands-on experience investigating security alerts, suspicious activity, account compromise, malware, phishing, or other security events is requiredExperience supporting a multi-site or distributed environment is preferredSKILLS, KNOWLEDGE & ABILITIES:Knowledge of and experience with vulnerability scanning, vulnerability remediation, patching, configuration review, or related exposure-management processesDemonstrated knowledge of and experience with Microsoft 365, Entra ID, Azure security controls, MFA, privileged-access concepts, Windows environments, identity and access management, and multi-factor authentication conceptsAbility to support security controls, audits, PCI DSS, NIST, CIS Controls, or other cybersecurity frameworks or compliance requirements is preferredStrong understanding of cybersecurity fundamentals including threats, vulnerabilities, risk, authentication, authorization, encryption, logging, and incident responseAbility to analyze security alerts and technical evidence across endpoint, identity, cloud, email, network, and application environmentsKnowledge of and experience with vulnerability-management tools and the ability to interpret scan findings, assess practical risk, and coordinate remediationFamiliarity with endpoint detection and response, email-security platforms, web filtering, firewall technologies, security logging, and monitoring toolsUnderstanding of common attack techniques including phishing, credential theft, malware, privileged escalation, lateral movement, data exfiltration, and social engineeringAbility to document investigations, security configurations, remediation actions, and control evidence clearly and accuratelyFamiliarity with scripting, automation, or data-analysis tools such as PowerShell, Python, APIs, or similar technology is preferredStrong analytical and problem-solving abilities with a methodical approach to investigation and troubleshootingHigh degree of integrity, discretion, and judgment when handling confidential information, security events, employee data, and privileged system accessStrong written and verbal communication skills with the ability to explain security concerns and recommended actions to both technical and non-technical audiencesAbility to remain calm, organized, and responsive during security incidents or other time-sensitive eventsDetail-oriented with strong documentation, follow-through, and evidence-management habitsAbility to work independently while collaborating effectively with infrastructure, cloud/POS, support, development, business teams, and external security partnersAbility to prioritize competing vulnerabilities, alerts, projects, and compliance requirements based on business riskCuriosity and commitment to continuous learning as technologies, attack methods, and security practices evolve #J-18808-Ljbffr