> Markdown version of [/jobs/ext/1918102-technical-incident-response-analyst-hybrid](https://www.wearedevelopers.com/jobs/ext/1918102-technical-incident-response-analyst-hybrid). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Technical Incident Response Analyst - Hybrid - **Company:** First American Bank - **Location:** Elk Grove Village, IL, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Application Firewall, User Authentication, Server Message Block, Cyber Security, Data Security, Linux, Internet Security, Intrusion Detection and Prevention, Intrusion Detection Systems, Network Security, Log Analysis, Microsoft Software, Network File Systems, Network Administration, Remote Access Technology, Phishing, Runbook, Security Information and Event Management, TCP/IP, Transmission Control Protocol (TCP), Time Tracking Software, Wide Area Networks, Computer Networking Systems, Malware, Firewalls (Computer Science), Malware Detection, Kibana, Network Server - **Published:** August 4, 2026 - **Apply:** https://www.careerbuilder.com/job-details/technical-incident-response-analyst-hybrid-il-elk-grove-village-il--8c652ac8-8391-4b16-baf4-eda3a8b2b91c ## About the Role * Minimum of three years of experience directly related to incident response, security monitoring, or cybersecurity operations. * Hands-on experience with SIEM platforms, incident response tooling, and alert monitoring solutions. * Experience with firewall technologies, network security concepts, and endpoint protection platforms. * Experience performing log analysis and incident investigations across multiple data sources. * Exposure to Linux operating systems preferred. Working knowledge of: SIEM and security monitoring platforms Firewalls, TCP/IP networking, LAN/WAN infrastructure Endpoint protection and anti-malware solutions IDS/HIDS platforms Microsoft 365 security tools * Demonstrated ability to reconcile configuration changes and validate security controls. * Qualified military veterans are encouraged to apply. * Must be professional, comfortable speaking with external and internal contacts with a demonstrated ability to tailor the message appropriately to the audience and situation effectively. * Ability to relay technical information to both technical and non-technical personnel. * Ability to write technical documentation. * Demonstrated ability to convey thoughts and ideas effectively and succinctly via written formats, including emails, letters, and electronic platforms. Maintain professional standards relating to spelling and grammar. * Maintain credibility through professional demeanor, appearance, and presence by modeling standards appropriate to our environment and industry. * Maintain good working relationships with internal partners by exhibiting exemplary interpersonal skills, adopting a constructive, solutions-focused approach. * Use sound professional judgment to balance the interests of the organization and customer, understanding and using available resources to mitigate risks. * Proficiency with Microsoft 365 products and applications, including the ability to effectively prepare or review documents, procedures, and reports. * Proficiency in Network Management and Firewalls, Servers, TCP/IP Schema, Remote Access Solutions, & NFS/ISCCI/CIFS networking/storage interdependencies. * Demonstrated ability to learn new systems and applications, as well as the ability to understand, adapt and adjust responsibilities/workflows as a result of system upgrades. * Occasional travel to other First American Bank locations, Bank functions, and training facilities may be required. * Typical schedule is Monday through Friday 8:00 a.m. to 5:00 p.m. Additional hours may be required depending upon business need. * Rotational Saturday work and off-hours on-call availability. * Punctuality is required to maintain First American Bank's customer service standards. Skills: Analysis Skills, Authentication, CIFS (Common Internet File System), Change Management, Communication Skills, Community Banking, Computer Hacking, Computer Security, Customer Support/Service, Documentation, Documentation Review, Endpoint Security, Enterprise Protection, Financial Fraud, Firewall Administration, Firewalls, Incident Response, Information/Data Security (InfoSec), Internal Audit, Internet Security, Interpersonal Skills, Intrusion Detection Systems, Intrusion Prevention Systems, Leadership, Linux Operating System, Machine Tool, Malware, Microsoft Product Family, NFS (Network File System), Network Administration/Management, Network Security, Network Systems, On Call, Philosophy, Phishing, Reconciliation, Regulatory Compliance, Regulatory Requirements, Remote Access, Reporting Dashboards, Reporting Skills, Risk Management, Security Attacks, Security Information and Event Management (SIEM), Security Infrastructure, Security Monitoring, Systems Administration/Management, TCP/IP (Transmission Control Protocol/Internet Protocol), Technical Writing, Time Management, Time Tracking, Willing to Travel, Writing Skills ## Description The Technical Incident Response Analyst is responsible for monitoring, analyzing, and responding to cybersecurity alerts and incidents across enterprise infrastructure and security platforms. This role serves as a primary investigator for security events, ensuring timely detection, containment, remediation, documentation, and escalation of incidents in alignment with established incident response playbooks, regulatory requirements, and internal controls. The position combines real-time alert monitoring, technical investigation, firewall and configuration change validation, and execution of defined recurring operational tasks to maintain a strong security posture across the organization. DUTIES & RESPONSIBILITES * Monitor and respond to cybersecurity alerts generated from SIEM provider dashboards and security monitoring platforms. * Investigate, remediate, and document security incidents reported through automated alerts, tickets, emails, phone calls, or external SOC notifications. * Act as the primary investigator for potential security incidents identified by SOC analysts or monitoring tools. * Follow documented incident response playbooks while exercising sound judgment to contain and remediate threats. * Investigate phishing emails, user-reported security concerns, and potential attempts at fraud or financial loss. * Review authentication, endpoint, network, and application activity for anomalous or malicious behavior. * Analyze firewall logs, IDS alerts, intrusion prevention activity, anti-malware events, server logs, and application logs. * Monitor intrusion detection systems, for indicators of compromise or suspicious activity. * Correlate data across SIEM, IDS, endpoint, and firewall platforms to support incident investigations. * Perform log reviews using standardized incident response and log review templates. * Perform reconciliation of firewall rule and configuration changes. * Validate that all changes are authorized, approved, and compliant with change management and security policies. * Identify unauthorized or out-of-policy changes and escalate violations as required Execute daily, weekly, and periodic tasks defined in the Incident Response recurring task schedule, including: Reviewing Microsoft Defender security incidents and assigning or resolving alerts. Reviewing external SOC (e.g., Proficio) incident tickets to ensure proper closure. Reviewing SIEM and Kibana dashboards for authentication failures and other abnormal activity. Validating completion and documenting evidence through screenshots and reports. * Document incident activity, evidence, analysis, and remediation actions in an audit-ready manner. * Communicate incident status clearly to Information Security leadership, infrastructure teams, and management. * Provide incident reporting suitable for internal audit, regulatory examination, and compliance reviews. * Track incidents end-to-end to ensure timely closure and proper documentation. * Participate in SOC and security working group sessions to improve detection rules and reduce false positives. * Review and update automated alerts and incident response playbooks for accuracy and effectiveness. * Collaborate with networking, systems, endpoint, and application teams during investigations. ## Related Videos - [An Applied Introduction to eBPF with Go](https://www.wearedevelopers.com/videos/1075-an-applied-introduction-to-ebpf-with-go) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Debug a Kubernetes Operator](https://www.wearedevelopers.com/videos/487-debug-a-kubernetes-operator) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Turning Container security up to 11 with Capabilities](https://www.wearedevelopers.com/videos/718-turning-container-security-up-to-11-with-capabilities) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk)