Cyber Defense Analyst

Purpose of Position

The Security Analyst is a junior information security professional responsible for security monitoring, event investigation, operational support, control validation, documentation, and risk-based escalation across the enterprise.

This role is designed for individuals developing foundational cybersecurity expertise while building practical experience in security operations. Analysts are expected to develop proficiency in their assigned specialization while gaining working capability across adjacent security disciplines through cross-training, project participation, incident response activities, mentoring, and structured development opportunities.

The Detection & Incident Response specialization focuses on monitoring, investigating, documenting, and supporting the response to enterprise security events. This specialization is a primary area of focus, not an exclusive boundary. Analysts may support work across Information Security functions as business and operational priorities require.

Tasks and Responsibilities

• Monitor, triage, and investigate security alerts and events using endpoint, identity, network, cloud, SaaS, email, and SIEM telemetry.
• Assess event severity, business impact, and response priority using established processes and risk-based judgment.
• Coordinate investigative and response activities with MDR providers, technical teams, and business stakeholders.
• Execute approved containment and response actions within documented authority limits and procedures.
• Support incident containment, eradication, recovery, post-incident review, and corrective-action activities.
• Apply threat intelligence, indicators of compromise (IOCs), and contextual information during investigations.
• Collect, preserve, organize, and document investigative evidence.
• Maintain accurate incident records, timelines, findings, escalation decisions, and handoffs.
• Manage assigned investigations, cases, and response activities through completion while maintaining accurate status updates, documentation, and follow-up actions.
• Support detection tuning, alert validation, automation initiatives, and investigation workflow improvements.
• Participate in threat-hunting, detection-validation, and threat-informed analysis activities as assigned.
• Contribute to root-cause analysis and continuous improvement efforts following security incidents.
• Perform security analysis and operational activities within established procedures, controls, and authority limits.
• Apply foundational security principles across identity, endpoint, application, cloud, data, infrastructure, governance, and incident-management activities.
• Maintain complete and accurate documentation of analysis, decisions, evidence, approvals, exceptions, and escalations.
• Escalate ambiguous, high-risk, or high-impact situations appropriately.
• Participate in audits, assessments, control validation activities, tabletop exercises, major incidents, and enterprise initiatives.
• Collaborate with Information Security, IT, Engineering, Product, and business teams.
• Identify recurring issues, control gaps, and opportunities to improve security effectiveness, operational efficiency, and automation.
• Use approved automation, AI-assisted tools, and operational workflows appropriately to improve efficiency, consistency, and security outcomes.
• Develop and communicate meaningful security, operational, and risk-related metrics.
• Maintain procedures and runbooks and contribute to secondary coverage for critical security services.
• Support organizational priorities through incident response, project participation, cross-functional assignments, and rotational opportunities.
• Develop security skills that transfer across technologies, vendors, and platforms.
• Protect sensitive information, communicate effectively, manage competing priorities, and remain accountable for work quality.
• Performs routine investigations, operational activities, and assigned projects with limited supervision.
• Applies documented procedures and established response processes to identify, analyze, and escalate security events.
• Exercises judgment within defined authority limits and seeks guidance when situations exceed documented procedures or experience.
• Executes approved containment and response actions according to established processes.
• Escalates significant security events, business-impacting risks, policy exceptions, and unfamiliar situations to senior team members or leadership.
• Provides recommendations based on available evidence and analysis.

Minimum Education

Candidates may qualify through a combination of:

• Relevant formal education (Bachelor’s Degree in Cybersecurity, Information Technology, etc.).
• Industry-recognized cybersecurity certifications.
• Military training or service.
• Professional or technical experience.
• Demonstrated technical aptitude, continuous learning, and practical cybersecurity skills are valued equally with formal education.

Minimum Experience

• Two to four years of experience in cybersecurity, IT operations, system administration, networking, cloud administration, identity management, technical support, engineering, risk management, audit, software delivery, military service, or related disciplines.
• Relevant experience may be gained through cybersecurity, IT operations, engineering, technical support, military service, security-focused projects, or other hands-on technical and professional development experiences.
• Direct experience in Detection & Incident Response is preferred but not required.

Knowledge, Skills, Abilities

• Foundational knowledge of cybersecurity threats, vulnerabilities, security controls, risk concepts, and incident-response practices.
• Understanding of common attacker tactics, techniques, and procedures (TTPs), phishing campaigns, malware, credential attacks, and other common threat activities.
• Familiarity with security monitoring, endpoint security tools, SIEM platforms, case management, and investigation processes.
• Ability to analyze logs, alerts, telemetry, and investigative artifacts from multiple security technologies.
• Ability to correlate information from multiple sources to determine the scope, impact, and potential risk of security events.
• Ability to assess event severity and determine when escalation or additional investigation is required.
• Ability to collect, organize, document, and present investigative evidence using established procedures.
• Ability to identify root causes, recognize control gaps, and support risk-informed recommendations.
• Ability to develop proficiency within a specialization while working effectively across multiple security domains.
• Ability to learn new technologies, security concepts, tools, and operational processes.
• Ability to identify opportunities to improve reliability, usability, automation, and control effectiveness.
• Ability to write clear documentation, procedures, case notes, findings, and stakeholder communications.
• Ability to communicate technical findings, risks, and recommendations to technical and non-technical audiences.
• Ability to manage multiple priorities in a fast-paced environment.
• Ability to collaborate effectively across technical, business, vendor, remote, and virtual teams.
• Demonstrated integrity, professionalism, sound judgment, and appropriate handling of sensitive information.
• Demonstrated curiosity, analytical thinking, and a willingness to investigate, learn, and continuously improve security knowledge and technical skills.

Physical Demands and Work Environment

The physical demands and work environment described here are representative of those that must be met and/or encountered by an employee to successfully perform the essential functions of this job.  Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee is regularly required to use hands to finger, handle, or feel; reach with hands and arms; and communicate.  The employee may be required to stand, walk, and sit. Specific vision abilities required by this job include the ability to view monitors, technical documents, and reference material. The noise level in the work environment is usually low to moderate. The employee may occasionally lift and/or move up to 20 pounds. Travel may be required based on program and customer needs.