Cybersecurity Analyst – Tier 2

Role overview

Security analysis and incident response

• Analyze escalated incidents, validate complex alerts, determine confirmed incident scope, impact, and severity, and investigate logs, network telemetry, and endpoint activity.
• Develop and tune detection rules, use cases, and correlation logic; conduct threat hunting and collaborate with threat intelligence teams.
• Perform forensic analysis and malware reverse engineering when needed; document findings, actions, and recommended next steps.
• Support active incidents by collecting evidence, containing low-severity threats under playbooks, and recommending containment and remediation.
• Follow runbooks and customer agreements to deliver consistent response actions.

Access and vulnerability management

• Process user access additions, removals, and modifications; enforce least privilege and role-based access standards; and conduct periodic access reviews.
• Investigate and escalate suspicious access activity or unauthorized access attempts.
• Track and verify patch status, monitor patch-related alerts, validate missing patches found in scans, coordinate remediation with IT operations, and escalate high-risk findings.

Reporting and continuous improvement

• Generate incident reports and daily shift summaries and communicate event details to internal teams.
• Recommend improvements to detection rules, response processes, SOC procedures, and technologies.
• Participate in detection validation and lessons-learned activities; stay current on cyber threats and attacker techniques.
• Mentor junior analysts and contribute to training programs.

Required qualifications

• 5+ years of cybersecurity experience, with at least 2 years in a SOC or incident response role.
• Advanced expertise in SIEM, EDR, and forensic tools.
• Strong understanding of MITRE ATT&CK and threat actor tactics, techniques, and procedures.
• Experience with scripting and automation such as Python or PowerShell.
• Ability to lead incident response efforts under pressure.
• Relevant security certifications from ISC2 or ISACA.
• Excellent communication and leadership skills.

Preferred qualifications

• Bachelor's degree in IT, Cybersecurity, or Computer Science preferred.
• Preferred certification examples include CompTIA Security+, Microsoft SC-200, CEH, CySA+, and GIAC certifications such as GSEC, GCIH, or GMON.
• Experience with IDS/IPS and network security tools, SIEM/SOAR workflows or playbooks, and threat intelligence platforms is preferred.