> Markdown version of [/jobs/ext/3786024-cybersecurity-operations-analyst](https://www.wearedevelopers.com/jobs/ext/3786024-cybersecurity-operations-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cybersecurity Operations Analyst

- **Company:** First Technology Federal Credit Union
- **Location:** Hillsboro, OR, United States
- **Experience:** Experienced
- **Salary:** $83,000.0 - $109,450.0
- **Contract:** Permanent contract
- **Skills:** Cloud Computing Security, Cyber Security, Query Languages, Intrusion Detection and Prevention, Network Security, Anti-Phishing, Security Information and Event Management, Software Vulnerability Management, Scripting, Mitre Att&ck, Cyber Threat Analysis
- **Published:** October 16, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=dcff3f25c7cadb62

## About the Role

* Required Education: Bachelors degree in field relevant to role (or 4 additional years of relevant experience in lieu of a degree)
 * Required Experience: 2+ years of relevant experience
 * Working knowledge of security operations, incident response, threat detection, vulnerability management, and common attack techniques, with the ability to apply established frameworks such as MITRE ATT&CK and the NIST Cybersecurity Framework.
 * Hands-on experience using SIEM, such as CrowdStrike Next-Gen, endpoint detection and response, identity, email security, network security, cloud security, case management, and threat intelligence tools in an enterprise environment.
 * Ability to analyze logs and security telemetry, correlate events across multiple data sources, distinguish true positives from benign activity, and communicate evidence-based conclusions.
 * Ability to manage routine and moderately complex investigations independently, prioritize concurrent work based on risk and service-level expectations, and recognize when escalation is required.
 * Strong written and verbal communication skills, including the ability to produce concise technical documentation and explain risk, impact, findings, and recommended actions to technical and nontechnical audiences.
 * Demonstrated judgment, attention to detail, discretion with sensitive information, customer focus, collaboration, and commitment to continuous learning in a rapidly changing threat environment.
 * Familiarity with scripting, query languages, or automation used for investigation and operational improvement is preferred.
 * Relevant industry certifications, such as Security+, CySA+, GCIH, GCIA, SC-200, or vendor-specific certifications, are preferred and may be considered alongside equivalent practical experience.

## Description

* Monitor and triage alerts from security technologies, including endpoint, identity, email, network, cloud, vulnerability-management, and SIEM platforms; validate severity, scope, and potential business impact.
 * Investigate suspected phishing, malware, compromised credentials, unauthorized access, data exposure, anomalous behavior, and other security events using available telemetry, threat intelligence, and documented procedures.
 * Execute incident-response procedures by containing threats within approved authority, preserving relevant evidence, documenting investigative timelines, and escalating high-severity or complex incidents to senior analysts and leadership.
 * Develop and perform threat hunts and detection validation activities based on emerging threats, vulnerabilities, indicators of compromise, adversary behaviors, and gaps identified through incidents or control reviews.
 * Tune security detections and alert workflows to improve fidelity, reduce unnecessary noise, document rationale and testing results, and ensure changes follow established review and change-management processes.
 * Create and maintain clear case records, dashboards, metrics, reports, runbooks, knowledge articles, and shift handoffs that support auditability, operational continuity, and leadership awareness.
 * Collaborate with infrastructure, network, cloud, identity, application, fraud, risk, and help-desk teams to coordinate remediation, validate recovery, and address recurring control weaknesses.
 * Participate in an on-call or after-hours response rotation as assigned, support security exercises and post-incident reviews, and share knowledge through peer mentoring and cross-training.