Cyber Security Analyst

Job summary

Monitor, investigate, and respond to security alerts and incidents, including containment, root cause analysis, and escalation. Improve JSOC operations through detection tuning, threat hunting, tool administration, playbook development, documentation, and reporting.

Job details

Our client is looking to add a Cybersecurity Analyst to their team. Its a contract role with 100% remote working conditions. There are some shifts as well Schedule: M-F 5PM-9AM (off hours); 5PM-1AM EST and 1AM-9AM EST shifts Job Description: The Analyst, JSOC is responsible for monitoring, analyzing, and independently responding to security alerts and incidents across the organization. As a core member of the Joint Security Operations Center (JSOC), this role protects the organization’s systems and data through threat detection, incident response, detection engineering, security monitoring, tool administration, and continuous improvement of security operations. Security Monitoring, Alert Triage & Incident Response (50%) - Monitor security alerts and events from JSOC tools and platforms; ensure the security queue is triaged within established SLAs. - Independently investigate, triage, contain, and resolve cybersecurity incidents across the full incident response lifecycle. - Perform root cause analysis and document findings and remediation actions. - Assign incident severity based on established criteria and escalate high-severity incidents in accordance with procedures. - Participate in after-hours and on-call incident response as required. Threat Detection & Alert Tuning (10%) - Analyze alert trends and identify opportunities to reduce false positives and improve signal quality. - Develop, tune, and maintain detection rules, correlation logic, and use cases across security platforms. - Improve monitoring coverage and detection effectiveness; validate and test new alerting capabilities. - Map detections to MITRE ATT&CK techniques to identify and close coverage gaps. JSOC Playbooks & Process Improvement (15%) - Develop, maintain, and update JSOC playbooks, runbooks, and standard operating procedures. - Identify opportunities to improve incident response processes and operational efficiency. - Document lessons learned and incorporate improvements into JSOC procedures. Security Tool Administration & Optimization (5%) - Serve as technical owner for assigned security platforms (SIEM, EDR/XDR, email security, and similar). - Manage day-to-day configuration, monitoring, and optimization of assigned tools. - Work with vendors and internal teams to troubleshoot issues and implement enhancements. - Ensure tools operate effectively and generate actionable alerts. Threat Hunting & Threat Intelligence (10%) - Conduct proactive, hypothesis-driven threat hunting activities. - Investigate suspicious activity, compromised accounts, malware infections, and phishing incidents. - Operationalize threat intelligence to improve detection and response; track relevant threat actors and TTPs. Reporting & Documentation (10%) - Maintain detailed incident records and investigation notes; ensure tickets are complete and accurate. - Contribute to operational metrics, dashboards, and management reporting (e.g., MTTD, MTTR). - Support security audits, compliance activities, and evidence collection as required. Minimum Education Level: Bachelor’s Degree (Computer Science, Cybersecurity, or related) Nice to Have Certifications: CISSP, GCIA, GCIH, GSEC, SC-200, or equivalent

What you’ll do

Monitor, investigate, and respond to security alerts and incidents, including containment, root cause analysis, and escalation. Improve JSOC operations through detection tuning, threat hunting, tool administration, playbook development, documentation, and reporting.

Requirements

A bachelor's degree in Computer Science, Cybersecurity, or a related field is listed as the minimum education requirement. CISSP, GCIA, GCIH, GSEC, SC-200, or equivalent certifications are nice to have; no specific years of experience are stated.

Listed skills

• Root Cause Analysis · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Security Monitoring
• Alert Triage
• Incident Response
• Root Cause Analysis
• Threat Detection
• Detection Engineering
• SIEM Administration
• EDR/XDR Administration
• Threat Hunting
• Threat Intelligence
• MITRE ATT&CK
• Playbook Development
• Security Tool Optimization
• Incident Documentation
• Security Auditing
• Operational Metrics

Job areas

• Security & Safety
• Technology

More jobs from OnX