Cyber Security Analyst

Role overview

Security monitoring and incident response

• Triage, investigate, contain, and remediate incidents and alerts, using Microsoft Defender XDR to assess suspicious activity.
• Investigate users, devices, indicators of compromise, suspicious emails, URLs, attachments, and potentially compromised identities.
• Document investigation decisions and actions, and work with external security services and internal IT teams.

Identity security

• Investigate risky users and sign-ins in Microsoft Entra ID and determine whether suspicious behavior is legitimate.
• Analyze sign-in and audit activity using Entra ID, Identity Protection, Conditional Access, logs, and Advanced Hunting/KQL.

Vulnerability management

• Monitor newly disclosed vulnerabilities and CVEs, assess their relevance and impact, and identify affected assets and services.
• Coordinate remediation plans with technical teams, track ownership and status, and escalate overdue or high-risk vulnerabilities.
• Identify recurring issues and help reduce exposure through improved patching, removal of unnecessary software, or technical controls.

Security engineering and collaboration

• Contribute to security improvements across endpoint, cloud, and identity environments.
• Work with infrastructure, endpoint, cloud, service desk, and other technical teams to investigate issues and drive remediation.

Technologies

• The environment includes Microsoft Defender XDR/Defender for Endpoint, Microsoft Entra ID and Identity Protection, Microsoft Sentinel, and Microsoft Defender for Cloud.
• Other technologies include KQL and Advanced Hunting, Conditional Access, ANY.RUN, and Azure and Microsoft 365 security tools.
• Experience with all listed technologies is not essential.

Candidate profile

• A solid grounding in cybersecurity and a desire to take an active role in investigations.
• Ideally, experience in security operations or SOC work, incident investigation and response, vulnerability management, Microsoft Defender, Microsoft Entra ID, security-log analysis, and KQL.
• The role suits someone curious who wants to understand why security events occurred.