Information Security Analyst

What You'll Do

• Security Monitoring & Analysis:
• Analyze cloud security posture on Azure-hosted systems and networks using Defender for Cloud and Defender XDR/EDR.
• Continuously monitor security logs and data sources integrated into Microsoft Sentinel, ensuring comprehensive coverage and efficient analysis that identifies potential security incidents or vulnerabilities using alert guides and methods based on the MITRE ATT&CK framework.
• Respond to security incidents by investigating alerts, performing triage, and executing remediation actions. Automate incident response workflows using Azure Logic Apps.
• Conduct real-time, proactive threat hunting analysis using KQL to identify and mitigate potential security risks and perform forensic investigations as necessary.
• Perform continuous vulnerability scans of the attack surface.
• Develop and publish alert guides, knowledge base articles, and training material.
• Configure and analyze threat Intel feeds to identify cyber threats and make recommendations proactively.
• Develop and optimize analytic rules in Azure Sentinel to detect potential threats and anomalies. Analyze client environments and configurations to identify issues and opportunities for improvement proactively.


• Incident Response:
• Lead or assist in the incident response process from detection through resolution.
• Develop, document, and implement incident response plans and playbooks.
• Collaborate with cross-functional teams to mitigate and recover from security incidents.
• Document Root Cause Analysis and Incident Event Reports.
• Analyze and improve security automation rules to reduce mean time to remediation.  


• Vulnerability and Risk Management:
• Perform regular vulnerability assessments and risk analyses.
• Recommend and implement measures to address identified security risks.
• Stay current on emerging threats, vulnerabilities, and Microsoft security technologies.
• Perform Phishing Attack exercises across the enterprise and MSSP clients.


• Policy Development & Compliance:
• Assist in creating and enforcing security policies, procedures, and guidelines.
• Ensure adherence to industry regulations and standards (e.g., NIST SP 800-171, ISO 27001 (2022), GDPR, PCI-DSS, HIPAA).
• Participate in security audits, security questionnaires, penetration tests, and provide reports and recommendations for improvements.


• Collaboration & Communication:
• Produce monthly security posture reports with Security KPIs for MSSP clients. 
• Communicate security issues and recommendations to technical and non-technical stakeholders.
• Provide security awareness training and support to employees across the organization.
• Work closely with other security teams and stakeholders to enhance the overall security posture of client organizations.
• Provide recommendations for improving threat protection practices.
• Excellent verbal and written communication skills. Ability to present findings and recommendations effectively.

The Skills You Need

• Technical Skills:
• Hands-on experience with Azure Sentinel, including developing analytic rules and automated workflows. Familiarity with network security tools (IDS/IPS, firewalls, antivirus solutions) and endpoint protection technologies.
• Experience with vulnerability assessment tools and risk management frameworks.
• Proficiency in Kusto Query Language (KQL.  Must have experience in creating and optimizing queries for threat detection and investigation.


• Soft Skills:
• Strong interpersonal and presentation skills.
• Strong analytical and problem-solving abilities.
• Excellent verbal and written communication skills.
• Ability to work effectively both independently and as part of a team.
• Detail-oriented with a proactive approach to security challenges.
• Team player, task-oriented, and eager to learn. 

Qualifications

• Education & Experience:
• Bachelor’s degree in computer science, Information Security, related field, or equivalent work experience.
• Minimum of 3 years in cybersecurity, focusing on security operations and incident response. At least 2 years of experience with Azure Sentinel.


• Certifications:
• SC-200 - Security Operations Analyst Associate
• AZ-500 - Azure Security Engineer Associate
• Certifications such as CompTIA Security+, Certified Cyber Security Analyst, CCSP, or equivalent preferred.