Security Operations Analyst

About the Role

The Security Operations Analyst serves as the first line of defense for Office Ally's security program, monitoring and triaging alerts across a broad set of security platforms spanning SIEM, endpoint detection and response, identity, email security, and data protection. This is a hands-on role with real ownership: you'll close incidents, investigate anomalies, and help build the runbooks and detection logic that make the next response faster.

This role works closely with the security engineering team, cloud infrastructure, and IT operations to investigate threats, coordinate response actions, and maintain the audit trail required by our applicable regulatory and compliance obligations.

What You’ll Do

Incident Triage & Response

• Monitor and triage security incidents across our environment - assessing severity, investigating context, and closing or escalating with clear, complete documentation
• Investigate Endpoint alerts: review device timelines, process trees, and file events; initiate live response sessions when needed
• Analyze Internal alerts - risky OAuth applications, unusual download activity, shadow IT, and policy violations
• Manage Security investigations - correlate log data, track User Behavior Analytics alerts, and coordinate vulnerability findings through triage and remediation
• Track and document all incidents in tickets, maintaining complete investigative records that serve as audit evidence and support post-incident review

Email & Collaboration Security

• Triage - phishing, malicious attachments, BEC attempts, and user-reported messages
• Review email threat investigation findings and coordinate remediation actions including message recall, sender block, and user notification
• Monitor chat and file share activity for anomalous sharing behavior, external collaboration risks, and DLP policy hits

Threat Detection & Hunting

• Run advanced hunting queries (KQL) to investigate indicators of compromise and identify threats not surfaced by automated rules
• Perform log analysis across sign-in logs, MDE device events, email transport logs, and cloud activity logs
• Use Identity logs to investigate on-premises login anomalies - lateral movement indicators, Kerberos abuse, and unusual authentication patterns
• Identify patterns of false positives and contribute to tuning requests and suppression logic for high-volume alert sources

Identity & Access Monitoring

• Review sign-in logs and Conditional Access policy results to identify compromised accounts, token abuse, MFA gaps, and authentication anomalies
• Support identity-related incidents including AD lockout investigation, account compromise response, and offboarding verification
• Verify Intune device compliance state during investigations - flag unmanaged or non-compliant devices involved in security events
• Identify accounts with stale sessions, unrevoked tokens, or privilege inconsistencies and escalate for remediation

Data Protection & Compliance

• Respond to DLP incidents across mail and file share, coordinating with data owners on sensitive data policy violations
• Support compliance program activities including control evidence collection, audit log review, and documentation of security control operation
• Flag potential data exposure events and escalate to security engineering with complete investigative context

Documentation & Process Improvement

• Write and maintain SOC runbooks and incident response procedures, keeping documentation current as the environment evolves
• Contribute to playbook improvements and false-positive suppression logic based on real triage experience
• Maintain accurate ticket incident records that support compliance audit trails and post-incident review

What You’ll Need

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent experience or relevant industry certifications
• 2+ years in a SOC, IT security, or incident response role
• Working knowledge of Microsoft Sentinel and the Microsoft Defender suite (MDE, MCAS, Defender for Identity, Defender for Office 365)
• Ability to read and write KQL - comfortable building hunting queries and modifying analytics rules
• Understanding of Active Directory and Entra ID fundamentals: sign-in flows, token lifetimes, Conditional Access, and MFA
• Familiarity with email-based threat investigation - phishing triage, header analysis, and safe/unsafe sender management
• Working knowledge of SOC 2, HIPAA, or HITRUST requirements and the role security operations plays in maintaining compliance
• Clear written communication - your incident notes are part of the compliance audit trail
• Ability to manage competing priorities in a fast-moving alert environment without losing investigative rigor

Nice to Have

• Rapid7 InsightIDR experience - LEQL queries, investigation dashboards, UBA alert triage
• Exposure to Palo Alto or similar NGFW log analysis
• Familiarity with Microsoft Intune device compliance and endpoint management concepts
• CompTIA Security+, SC-200 (Microsoft Security Operations Analyst), or equivalent certification
• Experience with PowerShell for basic automation, log parsing, and remediation scripting
• Prior experience supporting SOC 2 Type II, HITRUST, or HIPAA audit evidence collection
• Healthcare, SaaS, or regulated industry background
• Experience working in Jira for incident tracking and workflow management

Travel Requirements

• This role requires up to 5% travel, which may include client meetings, team gatherings, or company events.
• Travel will typically be scheduled in advance and supported by the company.

Office Ally Pay Transparency 90000 - 100000 USD