incident response analyst

Flexential

<div><p><b>Job Description:</b></p>
Responsible for the initial analysis, and classification of customer cases, as well as following troubleshooting documentation to quickly assess the customer situation and escalate if needed. IT Specialist will also work with the customer through different types of media, to provide a superior customer experience through tactical troubleshooting, monitoring, and proactive incident resolution for Flexential's customer environments<br>
<br>
A strong combination of technical analysis, troubleshooting, documentation skills, quick and friendly communication is vital to the IT Specialist role.<div><p><b>
Key Responsibilities and Essential Job Functions</b></p></div><ul><li>
Provides initial analysis and triage for incoming customer calls, monitoring alerts, and customer submitted tickets.</li><li>
Establish friendly initial communications to customers to let them know we hear and understand what the request/incident, and set concise and clear expectations to the customers&rsquo; requests and incidents in a prompt manner</li><li>
Document resolution and proactive status updates to technical issues clearly for customers and team members</li><li>
Works closely with our Level 2 support team to stay current on technology trends and information technology concepts</li><li>
Collaborate with customers and teammates to determine improvement areas in capabilities and processes</li><li>
Resolve customer requests and incidents with a high sense of urgency and ownership</li><li>
Be a team player focused on collective improvement and growth</li><li>
Align to ITIL best practices</li><li>
High paced work environment, where our system administrators will need to prioritize workloads.</li><li>
Effectively works with vendors to create resolution</li></ul><p></p><div><p><b>
Required Qualifications</b>
</p></div><ul><li>Working knowledge of relevant operating systems (see below)</li><li>
Attention to detail</li><li>
Good organization, time management, and prioritization</li><li>
Ability to troubleshoot and think critically</li><li>
Effective communication skills, including phone etiquette, writing, and active listening</li><li>
Great customer services skills</li><li>
Thrives in a fast-paced environment</li><li>
Continually seeking new knowledge curious by nature</li></ul><p></p><div><p><b>
Preferred Qualifications</b></p></div><ul><li>
Positive attitude with a strong sense of urgency and ownership of quality work deliverables</li><li>
Excellent verbal and written communications skills</li><li>
Associate degree in Computer Science, Information Technology, System Administration, or a closely related field, or equivalent experience required</li><li>
1-3 years of system administration, network, or database administration experience</li><li>
2 -3 years of Customer Service experience.</li><li>
Network +, Security + and / or CCNA desired</li><li>
Microsoft MCP or MCSA preferred</li><li>
Use of command line tools such as CMD, Telnet, SSH, GIT, and SCP (Powershell, Bash or VBScript language skills is a plus)</li><li>
Current experience applying troubleshooting techniques across various server, application, and network technologies including:<ul><li>
Remote Desktop, SSH, FTP</li><li>
Microsoft Server Technologies</li><li>
VMWare and/or other virtualization technologies</li><li>
Linux (or other *nix platforms)</li><li>
VLAN&rsquo;s, ACL&rsquo;s, IP subnets</li><li>
Networking and Switching concepts</li><li>
Load Balancing</li><li>
Firewall Configuration (Fortigate, Cisco ASA)</li></ul></li></ul><p></p><p><b>
Base Pay Range</b>: Hourly salary range offered for this position is estimated to be<b> </b><b>$24 - $26</b>. However, the actual pay range depends on each candidate&rsquo;s experience, location, and qualifications.</p><p></p><div><p><b>
Training Details</b></p><ul><li>
This role includes a training period covering the technical work, processes, and client communication to fully prepare you for success in the role.</li><li>
Duration: 3 months</li><li>
Schedule: Day Shift (Monday - Thursday or Tuesday - Friday)</li></ul><p></p><p><b>
Shift Information</b></p><ul><li>
After completion of the training period, your assigned shift will be based on business needs.</li><li>
Potential shift schedules: 8:00 AM to 7:00 PM or 8:00 PM to 7:00 AM</li><li>
Potential shift workdays: Sunday to Wednesday or Wednesday to Saturday</li></ul></div><p></p><div><p><b>
Physical Requirements</b>
</p></div><ul><li>Ability to sit for extended periods of time</li><li>
Walk or Stand for 50% of the time</li><li>
Moderate or advanced keyboard usage</li><li>
Lift 50 lbs.</li></ul><p></p><p><b><i>
Not meeting every single requirement? No problem! We are looking for candidates who possess unique skills that set them apart from the rest. If you're enthusiastic about this role and believe you have the skills and abilities that would make you successful, don't hesitate to apply today!</i></b></p><p></p><div>
Benefits of working at Flexential:
<br>
<ul><li>Medical, Telehealth, Dental and Vision</li><li>401(k)</li><li>Health Savings Accounts (HSA) and Flexible Spending Accounts (FSA)</li><li>Life and AD&amp;D</li><li>Short Term and Long-Term disability</li><li>Flex Paid Time Off (PTO)</li><li>Leave of Absence</li><li>Employee Assistance Program</li><li>Wellness Program</li><li>Rewards and Recognition Program</li></ul></div><p></p><p>
Benefits are subject to change at the Company's discretion.</p><p></p><p>
Flexential participates in the E-Verify program. Please click here for more information.</p><p></p><p><b>
EEOC Statement: </b>Flexential is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.</p></div>

Incident Response Analyst I

<div>
 <strong>
  Job Description:
  <br/>
  <br/>
 </strong>
 Responsible for the initial analysis, and classification of customer cases, as well as following troubleshooting documentation to quickly assess the customer situation and escalate if needed. IT Specialist will also work with the customer through different types of media, to provide a superior customer experience through tactical troubleshooting, monitoring, and proactive incident resolution for Flexential's customer environments
 <br/>
 <br/>
 A strong combination of technical analysis, troubleshooting, documentation skills, quick and friendly communication is vital to the IT Specialist role.
 <br/>
 <br/>
 <strong>
  Key Responsibilities And Essential Job Functions
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Provides initial analysis and triage for incoming customer calls, monitoring alerts, and customer submitted tickets.
  </li>
  <li>
   Establish friendly initial communications to customers to let them know we hear and understand what the request/incident, and set concise and clear expectations to the customers&rsquo; requests and incidents in a prompt manner
  </li>
  <li>
   Document resolution and proactive status updates to technical issues clearly for customers and team members
  </li>
  <li>
   Works closely with our Level 2 support team to stay current on technology trends and information technology concepts
  </li>
  <li>
   Collaborate with customers and teammates to determine improvement areas in capabilities and processes
  </li>
  <li>
   Resolve customer requests and incidents with a high sense of urgency and ownership
  </li>
  <li>
   Be a team player focused on collective improvement and growth
  </li>
  <li>
   Align to ITIL best practices
  </li>
  <li>
   High paced work environment, where our system administrators will need to prioritize workloads.
  </li>
  <li>
   Effectively works with vendors to create resolution
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Required Qualifications
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Working knowledge of relevant operating systems (see below)
  </li>
  <li>
   Attention to detail
  </li>
  <li>
   Good organization, time management, and prioritization
  </li>
  <li>
   Ability to troubleshoot and think critically
  </li>
  <li>
   Effective communication skills, including phone etiquette, writing, and active listening
  </li>
  <li>
   Great customer services skills
  </li>
  <li>
   Thrives in a fast-paced environment
  </li>
  <li>
   Continually seeking new knowledge curious by nature
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Preferred Qualifications
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Positive attitude with a strong sense of urgency and ownership of quality work deliverables
  </li>
  <li>
   Excellent verbal and written communications skills
  </li>
  <li>
   Associate degree in Computer Science, Information Technology, System Administration, or a closely related field, or equivalent experience required
  </li>
  <li>
   1-3 years of system administration, network, or database administration experience
  </li>
  <li>
   2 -3 years of Customer Service experience.
  </li>
  <li>
   Network +, Security + and / or CCNA desired
  </li>
  <li>
   Microsoft MCP or MCSA preferred
  </li>
  <li>
   Use of command line tools such as CMD, Telnet, SSH, GIT, and SCP (Powershell, Bash or VBScript language skills is a plus)
  </li>
  <li>
   Current experience applying troubleshooting techniques across various server, application, and network technologies including:
  </li>
  <ul>
   <li>
    Remote Desktop, SSH, FTP
   </li>
   <li>
    Microsoft Server Technologies
   </li>
   <li>
    VMWare and/or other virtualization technologies
   </li>
   <li>
    Linux (or other *nix platforms)
   </li>
   <li>
    VLAN&rsquo;s, ACL&rsquo;s, IP subnets
   </li>
   <li>
    Networking and Switching concepts
   </li>
   <li>
    Load Balancing
   </li>
   <li>
    Firewall Configuration (Fortigate, Cisco ASA)
    <br/>
   </li>
  </ul>
 </ul>
 <strong>
  Base Pay Range
 </strong>
 : Hourly salary range offered for this position is estimated to be
 <strong>
  $24 - $26
 </strong>
 . However, the actual pay range depends on each candidate&rsquo;s experience, location, and qualifications.
 <br/>
 <br/>
 <strong>
  Training Details
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   This role includes a training period covering the technical work, processes, and client communication to fully prepare you for success in the role.
  </li>
  <li>
   Duration: 3 months
  </li>
  <li>
   Schedule: Day Shift (Monday - Thursday or Tuesday - Friday)
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Shift Information
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   After completion of the training period, your assigned shift will be based on business needs.
  </li>
  <li>
   Potential shift schedules: 8:00 AM to 7:00 PM or 8:00 PM to 7:00 AM
  </li>
  <li>
   Potential shift workdays: Sunday to Wednesday or Wednesday to Saturday
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Physical Requirements
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Ability to sit for extended periods of time
  </li>
  <li>
   Walk or Stand for 50% of the time
  </li>
  <li>
   Moderate or advanced keyboard usage
  </li>
  <li>
   Lift 50 lbs.
   <br/>
   <br/>
  </li>
 </ul>
 <em>
  <strong>
   Not meeting every single requirement? No problem! We are looking for candidates who possess unique skills that set them apart from the rest. If you're enthusiastic about this role and believe you have the skills and abilities that would make you successful, don't hesitate to apply today!
   <br/>
   <br/>
  </strong>
 </em>
 Benefits of working at Flexential:
 <br/>
 <br/>
 <ul>
  <li>
   Medical, Telehealth, Dental and Vision
  </li>
  <li>
   401(k)
  </li>
  <li>
   Health Savings Accounts (HSA) and Flexible Spending Accounts (FSA)
  </li>
  <li>
   Life and AD&amp;D
  </li>
  <li>
   Short Term and Long-Term disability
  </li>
  <li>
   Flex Paid Time Off (PTO)
  </li>
  <li>
   Leave of Absence
  </li>
  <li>
   Employee Assistance Program
  </li>
  <li>
   Wellness Program
  </li>
  <li>
   Rewards and Recognition Program
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Benefits Are Subject To Change At The Company's Discretion.
  <br/>
  <br/>
 </strong>
 Flexential participates in the E-Verify program. Please click here for more information.
 <br/>
 <br/>
 <strong>
  EEOC Statement:
 </strong>
 Flexential is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.
</div>


Cherokee Federal

<div><div><div><b>Cyber Threat Analyst (Intermediate)<br>
</b></div></div><div></div><div><div>This position requires an active<b>Public Trust</b>clearance or the ability to obtain a <b>Public </b><b>Trust</b>clearance to be considered.<br>
</div></div><div></div><div><div>Cherokee Nation System Solutions, LLC is seeking a knowledgeable <b>Security Analyst, Journeyman </b>to join our cybersecurity team and support the organization&rsquo;s efforts to protect data and networks from unauthorized access. The Security Analyst will provide technical expertise in information security standards, monitor network activity for potential threats, and perform in-depth security event analysis. This role requires advanced knowledge of network protocols, firewalls, disaster recovery operations, and security best practices. The ideal candidate will be proactive in identifying threats and solving complex technical issues to enhance the organization&rsquo;s overall security posture.<br>
</div></div><div></div><div><div><b>Compensation &amp; Benefits:
</b></div></div><div><div><div>Estimated Starting Salary Range for<b>Cyber Threat Analyst (Intermediate)</b>: $107K-$115K
</div></div><div><div>Pay commensurate with experience.
</div></div><div><div>Full time benefits include Medical, Dental, Vision, 401K, and other possible benefits as provided. Benefits are subject to change with or without notice.<br>
</div></div><div></div><div><div><b>Cyber Threat Analyst (Intermediate)</b><b>Responsibilities Include:
</b></div></div><div><div>Incident Detection &amp; Response
</div></div><div><ul><li><div>Monitor, analyze, and triage security alerts from multiple sources including SIEM, EDR/XDR, and network monitoring tools
</div></li></ul></div><div><ul><li><div>Perform in-depth investigations of security incidents, including malware, phishing, lateral movement, and data exfiltration
</div></li></ul></div><div><ul><li><div>Lead incident response activities and recommend containment, eradication, and recovery actions
</div></li></ul></div><div><ul><li><div>Create incident reports documenting incident timelines, root cause analysis, and remediation recommendations
</div></li></ul></div><div><div>Endpoint &amp; Network Security Analysis
</div></div><div><ul><li><div>Analyze endpoint telemetry to identify suspicious behavior, persistence mechanisms, and exploitation techniques
</div></li></ul></div><div><ul><li><div>Investigate network traffic (e.g., DNS, HTTP(S), NetFlow, PCAP) for indicators of compromise (IOCs) and attacker activity
</div></li></ul></div><div><ul><li><div>Correlate endpoint and network data to identify threats and attack patterns
</div></li></ul></div><div><div>Cloud Security (AWS &amp; Azure)
</div></div><div><ul><li><div>Monitor and investigate security events in AWS and Azure environments
</div></li></ul></div><div><ul><li><div>Analyze CloudTrail, VPC flow, Azure Activity, and Azure AD/Entra ID logs to identify suspicious cloud activity
</div></li></ul></div><div><ul><li><div>Support cloud incident response and recommend security improvements
</div></li></ul></div><div><div>EDR and SIEM Detection &amp; Analysis
</div></div><div><ul><li><div>Utilize Splunk for log analysis, correlation searches, and dashboard creation
</div></li></ul></div></div><div><div><ul><li><div>Leverage Microsoft Defender XDR and Trellix Endpoint Security (HX) for threat hunting, alert triage, and response actions
</div></li></ul></div><div><ul><li><div>Develop and tune detection rules to improve alert fidelity and reduce false positives
</div></li></ul></div><div><ul><li><div>Create and maintain runbooks and standard operating procedures (SOPs)
</div></li></ul></div><div><div>Threat Hunting &amp; Intelligence
</div></div><div><ul><li><div>Conduct proactive threat hunting across endpoint, network, and cloud environments
</div></li></ul></div><div><ul><li><div>Integrate and apply threat intelligence to enhance detection and response capabilities
</div></li></ul></div><div><ul><li><div>Identify gaps in visibility and recommend improvements
</div></li></ul></div><div><div>Collaboration &amp; Mentorship
</div></div><div><ul><li><div>Act as escalation point for Tier 1 analysts
</div></li></ul></div><div><ul><li><div>Provide guidance and training to junior analysts
</div></li></ul></div><div><ul><li><div>Collaborate with to facilitate incident response and improve security posture<br>
</div></li></ul></div><div></div><div><div><b>Cyber Threat Analyst (Intermediate)</b><b>Experience, Education, Skills, Abilities requested:
</b></div></div><div><ul><li><div><b>Bachelor&rsquo;s degree </b>in Cybersecurity, Information Technology, Computer Science, or a related field is preferred.
</div></li></ul></div><div><ul><li><div>Minimum <b>3-5 years of experience </b>in security analysis, with a strong understanding of network protocols, traffic analysis, endpoint forensics and artifacts.
</div></li></ul></div><div><ul><li><div>Strong experience with Splunk (SPL, dashboards, correlation rules)
</div></li></ul></div><div><ul><li><div>correlation)
</div></li></ul></div><div><ul><li><div>Experience analyzing:
</div></li></ul></div><div><ul><li><div>Endpoint telemetry (EDR tools, host-based investigations)
</div></li></ul></div><div><ul><li><div>Network traffic (packet analysis, NetFlow, IDS/IPS alerts)
</div></li></ul></div></div><div><div><ul><li><div>Cloud logs (AWS and Azure)
</div></li></ul></div><div><ul><li><div>Familiarity with AWS (e.g., CloudTrail, GuardDuty , VPC logs)
</div></li></ul></div><div><ul><li><div>Familiarity with Microsoft Azure (e.g., Azure AD/Entra ID, Defender for Cloud)
</div></li></ul></div><div><ul><li><div>Experience with Microsoft Defender XDR (endpoint, identity, email, and cloud)
</div></li></ul></div><div><ul><li><div>Solid understanding of:
</div></li></ul></div><div><ul><li><div>MITRE ATT&amp;CK framework
</div></li></ul></div><div><ul><li><div>Common attack Tactics, Techniques, and Procedures (TTPs)<br>
</div></li></ul></div><div></div><div><ul><li><div><b>Relevant certifications:
</b></div></li></ul></div><div><ul><li><div>GIAC Certified Incident Handler (GCIH)
</div></li></ul></div><div><ul><li><div>GIAC Certified Forensic Analyst (GCFA)
</div></li></ul></div><div><ul><li><div>GIAC Certified Forensic Analyst (GCFE)
</div></li></ul></div><div><ul><li><div>CompTIA CySA +
</div></li></ul></div><div><ul><li><div>Microsoft Certified: Security Operations Analyst Associate (SC-200)
</div></li></ul></div><div><ul><li><div>Splunk Core Certified Power User
</div></li></ul></div><div><ul><li><div>Splunk Certified Cybersecurity Defense Analyst
</div></li></ul></div><div><ul><li><div><b>Preferred Skills:
</b></div></li></ul></div><div><ul><li><div>Experience with <b>SIEM tools </b>and network monitoring systems.
</div></li></ul></div><div><ul><li><div>Strong analytical and problem-solving skills with the ability to respond to complex security incidents.
</div></li></ul></div><div><ul><li><div>Scripting or automation skills (Python, PowerShell, Bash)
</div></li></ul></div></div><div><div><ul><li><div>Experience with SOAR platforms and automated response workflows
</div></li></ul></div><div><ul><li><div>Knowledge of digital forensics and malware analysis (basic to intermediate)
</div></li></ul></div><div><ul><li><div>Excellent communication skills, with the ability to clearly explain security issues and recommendations to technical and non-technical stakeholders.
</div></li></ul></div><div><ul><li><div>Must pass pre-employment qualifications of Cherokee Federal<br>
</div></li></ul></div><div></div><div><div><b>Company Information:
</b></div></div><div><div><b>Cherokee Nation System Solutions (CNSS)</b>is a part of Cherokee Federal &ndash; the division of tribally owned federal contracting companies owned by Cherokee Nation Businesses. As a trusted partner for more than 60 federal clients, Cherokee Federal LLCs are focused on building a brighter future, solving complex challenges, and <b>serving </b>the government&rsquo;s mission with compassion and heart. To learn more about<b>CNSS</b>, visit cherokee-federal.com.<br>
</div></div><div></div><div><div><b>#CherokeeFederal #LI-SM2 #AppC<br>
</b></div></div><div></div><div><div>Cherokee Federal is a military friendly employer. Veterans and active military transitioning to civilian status are encouraged to apply.
 </div></div><div><div><b>Keywords
</b></div></div><div><div><ul><li><div>Security Analyst
</div></li></ul></div></div><div><div><ul><li><div>Network Security
</div></li></ul></div></div><div><div><ul><li><div>Threat Detection
</div></li></ul></div></div><div><div><ul><li><div>SIEM Tools
</div></li></ul></div></div><div><div><ul><li><div>Incident Response
</div></li></ul><ul><li><div><b>Similar Job Titles
</b></div></li></ul></div></div></div><div><div><div><ul><li><div>Cybersecurity Analyst
</div></li></ul></div></div><div><div><ul><li><div>Network Security Analyst
</div></li></ul></div></div><div><div><ul><li><div>Information Security Specialist
</div></li></ul></div></div><div><div><ul><li><div>Threat Detection Specialist
</div></li></ul></div></div><div><div><ul><li><div>Incident Response Analyst<br>
</div></li></ul></div></div><div></div><div><div><b>Legal Disclaimer: </b>Cherokee Federal is an equal opportunity employer. Please visit cherokee-federal.com/careers for information regarding our Affirmative Action and Equal Opportunity Employer Statement, and Accommodation request.
</div></div><div><div>Many of our job openings require access to government buildings or military installations. Candidates must pass pre-employment qualifications of Cherokee Federal.</div></div></div></div>

Cyber Threat Analyst(Intermediate)

WENCOR

<div>
 For 68 years, HEICO Corporation, a NYSE traded company, has thrived by serving niche segments of the aviation, defense, space and electronics industries by providing innovative and cost-saving products and services. HEICO&rsquo;s high-energy culture focuses our Team Members on providing high quality products and services to our customer base, which is made up of most of the world&rsquo;s airlines, the defense industry, satellite manufacturers and other electronics companies. Our leadership approach creates a dynamic environment that continually challenges our Team Members to grow professionally and develop in an entrepreneurially-spirited setting.
 <br/>
 <br/>
 <strong>
  ROLE:
 </strong>
 The
 <strong>
  Senior IT Security Analyst
 </strong>
 applies advanced systems analysis techniques and deep cybersecurity operations expertise to protect sensitive and mission-critical systems across HEICO and its subsidiaries. This role serves as a senior technical escalation point for security monitoring and incident response, leads complex investigations, and drives continuous improvement of detection, response, and security hardening capabilities.
 <br/>
 <br/>
 The Senior IT Security Analyst acts as a trusted advisor and liaison to ensure security operations align with HEICO standards while accounting for subsidiary-specific business needs and technical nuances. The role mentors junior analysts, improves operational rigor (playbooks, automation, metrics), and supports compliance-driven security requirements through disciplined execution and documentation.
 <br/>
 <br/>
 <strong>
  Essential Duties And Responsibilities
  <br/>
  <br/>
 </strong>
 <li>
  Security Monitoring &amp; Triage
 </li>
 <ul>
  <li>
   Analyze and triage security alerts from managed detection and response (MDR) services and internal monitoring platforms; determine severity, scope, and required actions.
  </li>
  <li>
   Serve as an escalation point for high-impact or complex alerts and investigations; provide guidance to junior analysts during active cases.
  </li>
 </ul>
 <li>
  Incident Response Leadership
 </li>
 <ul>
  <li>
   Lead cybersecurity incident investigations, including evidence preservation, containment, eradication, and recovery validation in accordance with established procedures.
  </li>
  <li>
   Coordinate incident communications and technical actions across IT teams, impacted sites, and third-party providers; ensure timely escalation when elevated authorization is required.
  </li>
  <li>
   Perform post-incident reviews, document timelines and lessons learned, and implement improvements to reduce recurrence.
  </li>
 </ul>
 <li>
  Threat Investigation &amp; Analysis
 </li>
 <ul>
  <li>
   Conduct malware and suspicious artifact analysis using investigative tooling (including sandboxing) to determine behavior, impact, and mitigation steps.
  </li>
  <li>
   Perform proactive threat hunting to identify stealthy or low-signal adversary activity and improve detection coverage.
  </li>
 </ul>
 <li>
  Detection Engineering &amp; Security Tool Optimization
 </li>
 <ul>
  <li>
   Evaluate, tune, and optimize EDR/XDR detection logic, response policies, and automated containment actions to improve efficacy and reduce false positives.
  </li>
  <li>
   Enhance alert fidelity and investigative effectiveness through rule refinement, contextual enrichment, telemetry validation, and playbook improvements.
  </li>
  <li>
   Design and maintain application control and endpoint protection policies to strengthen visibility, restrict unauthorized software execution, and address detection or response gaps.
  </li>
  <li>
   Security Automation
  </li>
  <ul>
   <li>
    Develop, test, and implement SOAR/security automation workflows to improve response consistency and enable action when staffing is limited.
   </li>
   <li>
    Identify repetitive analyst tasks and implement automation to increase operational capacity and reduce mean time to respond (MTTR).
   </li>
  </ul>
  <li>
   Incident-Driven Vulnerability Escalation
  </li>
  <ul>
   <li>
    Escalate vulnerabilities or control weaknesses identified during incident response or threat hunting, providing technical impact analysis and attack-path context to the vulnerability management function.
   </li>
   <li>
    Confirm that remediation actions adequately address the specific incident vector or exploited control gap.
   </li>
  </ul>
  <li>
   Control Gap Identification &amp; Advisory
  </li>
  <ul>
   <li>
    Provide operational feedback on control effectiveness based on real-world incident activity and detection gaps (including emerging technology guidance such as AI usage controls).
   </li>
   <li>
    Recommend improvements to technical safeguards or enforcement mechanisms when investigative findings reveal system weaknesses (e.g., SOX and NIST-aligned requirements).
   </li>
  </ul>
  <li>
   Third-Party / MSP Oversight
  </li>
  <ul>
   <li>
    Engage third-party IT providers/MSPs to communicate HEICO security requirements and incident handling expectations (including evidence retention).
   </li>
   <li>
    Assess MSP execution against requirements, identify gaps, and escalate non-compliance through appropriate channels.
   </li>
  </ul>
  <li>
   Business Partnership, Reporting, and Travel
  </li>
  <ul>
   <li>
    Act as a liaison between HEICO Corporate security and supported subsidiaries to maintain alignment on security initiatives, upgrades, and operational expectations.
   </li>
   <li>
    Provide regular operational reporting (risk trends, incident metrics, remediation status, tooling effectiveness).
   </li>
   <li>
    Required quarterly travel to supported out-of-state sites (i.e. quarterly planned visits and additional travel during escalations) to understand environment baselines, strengthen stakeholder relationships, and improve response readiness.
   </li>
  </ul>
  <li>
   On-Call Support
  </li>
  <ul>
   <li>
    Participate in an on-call rotation and respond independently to security events outside standard business hours.
   </li>
   <li>
    Perform other professional cybersecurity duties consistent with the scope and level of the position.
   </li>
  </ul>
 </ul>
</div>


IT Security Operations Analyst

Capgemini

<div>
 <strong>
  About Capgemini
  <br/>
  <br/>
 </strong>
 Capgemini is a global leader in partnering with companies to transform and manage their business by harnessing the power of technology. The Group is guided everyday by its purpose of unleashing human energy through technology for an inclusive and sustainable future. It is a responsible and diverse organization of 350,000 team members in more than 50 countries. With its strong 55-year heritage and deep industry expertise, Capgemini is trusted by its clients to address the entire breadth of their business needs, from strategy and design to operations, fueled by the fast evolving and innovative world of cloud, data, AI, connectivity, software, digital engineering and platforms. The Group reported in 2022 global revenues of &euro;22 billion.
 <br/>
 <br/>
 <strong>
  Role Description
  <br/>
  <br/>
 </strong>
 Our Cyber Defense Unit is expanding, and we are looking for a talented Security Analyst to join our Incident Management &amp; Response (IMR) team. You will lead the lifecycle of major cybersecurity incidents, from identification through containment, eradication, and recovery, while coordinating with technical teams and executive stakeholders to ensure a timely and effective response.
 <br/>
 <br/>
 <strong>
  Key Responsibilities
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Lead and coordinate end-to-end cybersecurity incident response activities, ensuring incidents are fully resolved and lessons learned are documented.
  </li>
  <li>
   Manage escalations from L1 and L2 SOC analysts and CISO teams, including complex or specialist investigations.
  </li>
  <li>
   Act as the primary point of contact for Group-level cyber incidents, collaborating closely with both analyst teams and executive stakeholders.
  </li>
  <li>
   Deliver clear, concise status updates for stakeholders at all levels.
  </li>
  <li>
   Prepare comprehensive incident reports tailored to both technical and non-technical audiences.
  </li>
  <li>
   Interpret and present technical cybersecurity subjects to executives.
  </li>
  <li>
   Conduct in-depth technical investigations using SIEM, HIPS/NIPS, EDR/AV, UBEA, and other monitoring tools.
  </li>
  <li>
   Perform threat and vulnerability analysis and provide advisory services to CISO teams and internal stakeholders.
  </li>
  <li>
   Provide oversight for specialized investigations such as digital forensics and investigative interviews, ensuring alignment with standards and legislation.
  </li>
  <li>
   Define, improve, and support incident response processes, playbooks, and methodologies.
  </li>
  <li>
   Contribute to audit support and maintain documentation.
  </li>
  <li>
   Provide regular metrics, reports, and trend analysis across weekly and monthly cycles.
  </li>
  <li>
   Analyze and improve the effectiveness of existing use cases.
  </li>
  <li>
   Develop and deliver documentation, knowledge articles, and visual materials.
  </li>
  <li>
   Support lessons learned sessions and contribute to improving the Cyber Defense Unit&rsquo;s maturity.
  </li>
  <li>
   Stay current on emerging threats, technologies, and regulatory changes.
  </li>
  <li>
   you may participate in: User awareness campaigns, Phishing simulations, Vulnerability management, Cyber-scenario exercises, Security assurance activities
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Experience &amp; Qualifications
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   3+ years in Information Security or related fields.
  </li>
  <li>
   Incident management certifications such as CCIM, GCIH.
  </li>
  <li>
   Technical certifications such as GCFA, CHFI, CFCE.
  </li>
  <li>
   Vendor certifications such as CrowdStrike Falcon Responder, Splunk Cybersecurity Defense Analyst, EnCE.
  </li>
  <li>
   Experience with ITIL frameworks.
  </li>
  <li>
   Technical background in computing, networks, or programming.
  </li>
  <li>
   Familiarity with risk and control frameworks (e.g., NIST IR lifecycle, Cyber Kill Chain).
  </li>
  <li>
   Industry-recognized certifications such as CISSP or CISM.
  </li>
  <li>
   Proven experience handling cybersecurity incidents and risk management.
  </li>
  <li>
   Strong written and verbal communication skills in English.
  </li>
  <li>
   Experience in digital forensics, threat hunting, or enterprise‑scale incident response.
  </li>
  <li>
   Ability to manage multiple priorities in fast‑paced environments.
  </li>
  <li>
   Hands-on experience with SOC monitoring and intrusion detection tools (e.g., CrowdStrike, Splunk ES, VirusTotal Enterprise).
  </li>
  <li>
   Broad understanding of the cybersecurity threat landscape.
  </li>
  <li>
   Solid grasp of IT and security methodologies and technologies.
   <br/>
   <br/>
  </li>
 </ul>
 Choosing Capgemini means choosing a company where you will be empowered to shape your career in the way you&rsquo;d like, where you&rsquo;ll be supported and inspired by a collaborative community of colleagues around the world, and where you&rsquo;ll be able to reimagine what&rsquo;s possible. Join us and help the world&rsquo;s leading organizations unlock the value of technology and build a more sustainable, more inclusive world.
 <br/>
 <br/>
 Get the future you want | www.capgemini.com
</div>


SOC IMR Analyst

Naufar

<div>
 <p>
  <strong>
   JOB PURPOSE:
  </strong>
 </p>
 <p>
  The Cyber Security Analyst creates a comprehensive program for establishing a Healthcare carrier-class Security Operation Center. S/he develop and maintain threat monitoring and security incident response procedures within Naufar. The analyst designs frameworks, procedures, and toolkits to enhance capabilities in professional forensic collection and digital evidence analysis. S/he also develop dashboards for reporting the organization's threat landscape, Awareness and security posture to senior management. This role is expert role with roles and responsibilities.
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Description
  </strong>
 </p>
 <ul>
  <li>
   Develops and implements a cyber-security program to enhance Naufar capabilities regarding Cyber Attack incident monitoring, incidents response and intrusive and non-intrusive forensics capabilities.
  </li>
  <li>
   Develops and matures the service capabilities of the SOC, such as Forensics, Threat Management, Penetration Assessments, and Tool Management.
  </li>
  <li>
   Develops, Contributes and maintains of the cyber security strategy.
  </li>
  <li>
   Implements, configures and maintains security control and process, to ensure threat indicators are rated by severity and responded to in a manner consistent with the threat.
  </li>
  <li>
   Identifies deficiencies and recommends corrective action to strengthen information security control and decrease the risk of data breach.
  </li>
  <li>
   Maintains and updates standard operation policies and procedures for incident response plans, e-discovery processing, remote acquisition/analysis tools, collections and forensic analysis techniques.
  </li>
  <li>
   Maintains industry standard tools and processes used for forensic analysis and eDiscovery collections and processes.
  </li>
  <li>
   Monitors security alerts for potential events/incidents as well as trending and historical analysis and ensuring all incident reports are complete and written within standard operations and ensures ticket audits and reviews are completed
  </li>
  <li>
   Utilizes leading forensic software to identify, collect, preserve and analyze electronic data from laptops, desktops, servers, email archives, infrastructure logs, network file servers, backup tapes, cell phones, PDAs and a wide variety of other media devices.
  </li>
  <li>
   Manages requests for electronic data and digital forensic investigations that relate to Litigation, Regulatory matters, Compliance, and Employee Investigations.
  </li>
  <li>
   Performs cybersecurity incident analysis and assist with incident response, including analysis of network content and metadata for investigations or malware detection and identifies the cause and extent of a breach.
  </li>
  <li>
   Serves as a subject matter expert and technical advisor in matters relating to the proper collection, preservation, packaging, and submission of digital and multimedia evidence.
  </li>
  <li>
   Participates in incident electronic evidence collection activities in major field investigations. Ensures evidence handling requirements are met.
  </li>
  <li>
   Performs post-incident report according to standard operations.
  </li>
  <li>
   Analyzes the tools and methodology used for investigation and accordingly presents improvements in control and corrective actions if any.
  </li>
  <li>
   Escalates and works with senior management on resolutions to overdue security items or any negative trends identified.
  </li>
  <li>
   Develops focused reporting and briefings for advanced cyber threats.
  </li>
  <li>
   Conducts studies and research for improving forensic analyses, scientific methods, and resolving forensic examination problems.
  </li>
  <li>
   Creates detailed, professional documentation and reports, including performance metrics and presentations for management.
  </li>
  <li>
   Leads or contributes to key projects related to corporate threat monitoring, forensics or information security initiatives.
  </li>
  <li>
   Facilitates group risk assessment activities and identifies any security-related process improvement opportunities.
  </li>
  <li>
   Monitors and performs trending on root cause analysis activities within assigned group and participates as needed to resolve clinical systems security related incidents.
  </li>
  <li>
   Assists on monitoring compliance with information security policies, standards and ENTERPRISE-WIDE strategy and facilitates threat and vulnerability evaluations on a regular basis. Measures and reports on the effectiveness of information security controls.
  </li>
  <li>
   Supports the security initiatives, corrective and preventative actions, and security measures by ensuring timely updates and escalating concerns and non-compliances.
  </li>
  <li>
   Understands and maintains the appropriate knowledge of Security Technologies, (Firewall, Anti-Virus, Email and Web Encryption, HIPS, NIPS, SIEM, WAF, DLP), security procedures, and services within Naufar IT Security as well as ensures all tools are functioning properly.
  </li>
  <li>
   Keeps up to date on changes to significant regulatory and applicable standards issued by internal or external agencies, as applicable to the Naufar&rsquo;s domain.
  </li>
  <li>
   Adheres to Naufar&rsquo;s standards as they appear in the Code of Conduct and Conflict of Interest policies
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Academic Qualifications:
  </strong>
 </p>
 <ul>
  <li>
   Bachelor&rsquo;s degree &ndash; IT - Mandate
  </li>
  <li>
   Master&rsquo;s degree &ndash; Cybersecurity - Desired
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Experience Requirements:
  </strong>
 </p>
 <ul>
  <li>
   5+ years of experience working as a security analyst or SME within a Security Operations Center with exposure to cyber security collection, analysis and threats management, investigation and digital forensics.
  </li>
  <li>
   Demonstrated experience in threat detection and analysis, incident response, and reporting.
  </li>
  <li>
   Demonstrated experience with incident response, deep dive forensics, insider threat, cyber and data exfiltration incidents.
  </li>
  <li>
   Demonstrated experience conducting assessments, digital forensic investigations, vulnerability management and incident response.
  </li>
  <li>
   Demonstrated experience with current cyber threats and the associated tactics, techniques, and procedures used to infiltrate computer networks.
  </li>
  <li>
   Demonstrated experience with SEIM products in the detection, response, mitigation, and/or reporting of cyber threats
  </li>
  <li>
   Demonstrated experience in the use of forensic tools (e.g. FTK, Encase, Forensic Toolkit, X-Ways, Linux based tools, etc.)
  </li>
  <li>
   Experienced with (or equivalent) the following regulations and frameworks: PCI, HIPAA, and ISO/IEC 2700x
  </li>
 </ul>
</div>


Cyber Security Analyst

Alykas

<p><b>SOC Analyst &ndash; Alykas</b></p><p><b>About Alykas</b></p><p>Alykas is a US-based company providing intelligent, end-to-end IT and cybersecurity solutions designed for mid-market and enterprise organizations. Our mission is to deliver measurable outcomes that reduce risk, enhance operational efficiency, and turn technology into a strategic competitive advantage.</p><p>We offer a comprehensive portfolio of services, including <b>Managed IT Services, Cloud &amp; Data Center Solutions, IT Advisory &amp; Consulting, and Cybersecurity Solutions</b>. Our team of globally experienced, culturally aligned engineers provides consistent, expert support tailored to meet the complex needs of today&rsquo;s dynamic business environments.</p><p><b>Position Overview</b></p><p>As a <b>SOC Analyst</b> at <b>Alykas</b>, you will play a critical role in safeguarding our clients against evolving cyber threats through advanced security monitoring, analysis, and incident response. Working within a multi-tenant <b>Security Operations Center (SOC)</b>, you will support multiple clients using a range of cutting-edge cybersecurity technologies including <b>SIEM, EDR, MFA</b>, and more.</p><p>Your responsibilities will span <b>threat detection, incident triage, and proactive threat hunting</b>, as well as utilizing tools such as <b>PAM, email security, firewalls, and IAM systems</b> to enhance client security postures. Strong communication and collaboration skills are essential, as you&rsquo;ll regularly engage with clients and internal teams to ensure swift, effective responses to security challenges.</p><p><b>Key Responsibilities</b></p><ul><li>Monitor and analyze security alerts using SIEM platforms</li><li>Conduct initial triage, assess incident severity, and take appropriate response actions</li><li>Investigate indicators of compromise (IOCs) and document findings comprehensively</li><li>Respond to incidents following established playbooks and escalation procedures</li><li>Collaborate with cross-functional teams to resolve security incidents efficiently</li><li>Maintain accurate documentation of investigations, incidents, and remediation activities</li><li>Stay current with emerging cyber threats, technologies, and defensive strategies</li></ul><p><b>Must-Haves</b></p><ul><li>Minimum <b>3 years of experience</b> in a <b>Security Operations Center (SOC)</b></li><li>Proficiency with <b>endpoint detection tools</b> (e.g., SentinelOne, CrowdStrike, Microsoft Defender)</li><li>Hands-on experience with <b>incident response</b> and <b>ticketing systems</b></li><li>Strong <b>client-facing communication</b> and <b>reporting</b> skills</li><li>Familiarity with <b>firewall technologies</b></li><li><b>Fluent English communication skills</b>, both written and verbal essential for working with Alykas&rsquo;s international clients</li></ul><p><b>Experience With</b></p><ul><li><b>SIEM platforms</b> such as QRadar, Splunk, or AlienVault</li></ul><p><b>Nice-to-Haves (Plusses)</b></p><ul><li>Experience with <b>automation platforms (SOAR)</b> and <b>scripting</b> (e.g., Python)</li><li>Exposure to <b>Vulnerability Management</b> and <b>SCCM</b></li><li>Background in <b>Cyber Threat Hunting (CTH)</b> or <b>Cyber Threat Intelligence (CTI)</b></li><li>Relevant certifications such as <b>Security+, CySA+, CISSP, or CEH</b></li><li>Knowledge of <b>Identity and Access Management (IAM)</b>, particularly <b>Active Directory</b></li></ul><p><b>Benefits</b></p><ul><li><b>Competitive salary</b> based on experience</li><li><b>Performance-based bonus program</b></li><li><b>Comprehensive benefits package</b>, including health insurance and paid time off</li><li><b>Collaborative work environment</b> at world-class, state-of-the-art service delivery centers</li><li><b>Company-sponsored certifications</b> and ongoing professional development opportunities</li><li><b>Unlimited lab access</b> for hands-on learning and technical skill enhancement</li></ul><p><b>Join the Alykas Mission</b></p><p>At Alykas, we are driven by a shared mission &mdash; to defend digital assets, empower secure business operations, and deliver excellence in every interaction. If you&rsquo;re passionate about cybersecurity and eager to grow in a collaborative, globally engaged environment.</p><p><b>Apply today</b> and take the next step in your cybersecurity career with Alykas.</p><p>Job Type: Full-time</p><p>Pay: Rs120,000.00 - Rs170,000.00 per month</p><p>Language:</p><ul><li>English (Preferred)</li></ul><p>Work Location: In person</p>

SOC Analyst

Search 8130+ Incident response analyst jobs near you this April. New roles added regularly across leading industries. Apply today.

8130 incident response analyst jobs Near Me

Incident Response Analyst I

Incident Response Analyst I

Cyber Threat Analyst(Intermediate)

IT Security Operations Analyst

SOC IMR Analyst

Cyber Security Analyst

SOC Analyst