> Markdown version of [/jobs/ext/3953359-network-security-analyst-0056a](https://www.wearedevelopers.com/jobs/ext/3953359-network-security-analyst-0056a). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Network Security Analyst 0056A

- **Company:** Sistema Technologies, Inc.
- **Location:** San Antonio, TX, United States (Remote available)
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Cyber Security, Linux, File Systems, Issue Tracking Systems, Data Intelligence, Intrusion Detection Systems, Network Security, Linux System Administration, Log Analysis, Network Monitoring, Security Information and Event Management, In-Plane Switching (IPS), Mitre Att&ck, Malware, Falcon Platform, Cybercrime, Microsoft Sentinel, Data Management, SentinelOne Expertise
- **Published:** October 27, 2026
- **Apply:** https://www.careerbuilder.com/job-details/network-security-analyst-0056a-san-antonio-tx--dd73d201-ac56-416d-a50c-0583406172d5

## About the Role

Network Security, Security Analysis, Network Performance/Analysis, Microsoft Windows Operating System, Incident Response, Linux Operating System, Forensic Science, Analysis Skills, File Systems, Memory Hardware, Needed Required/
Preferred Skills/Experience
5 Advanced host-based forensics across Windows and Linux, including memory, disk, and malware analysis, using telemetry from NetWitness, Gravwell, Google SecOps, and Corelight to validate findings and reconstruct attacker activity.
5 Ability to correlate host, network, and intelligence data from CrowdStrike, SentinelOne, Microsoft Sentinel, Corelight, and NetWitness to build complete incident timelines.
5 Experience producing high-quality incident reports and executive summaries using evidence collected from Gravwell, NetWitness, Corelight, and case management workflows.
4 Strong understanding of adversary TTPs, intrusion kill chains, and threat hunting methodologies using packet-level and log-level data from but not limited to Corelight, NetWitness, and CRIBL pipelines.
3 Incident Commander experience
1 Experience supporting SLTT or critical infrastructure environments, including multi-tenant IR operations and cross-agency coordination.
5 Preferred Proficiency with threat intelligence platforms, including Recorded Future, ThreatMon, GreyNoise, Google Threat Intelligence, VirusTotal, and Mandiant, to enrich investigations, validate indicators, and map activity to MITRE ATT&CK.
5 Preferred Hands-on experience using Cyware CSAP for incident orchestration, automated enrichment, case creation, and workflow execution across SIEM, IPS, EDR, and ticketing systems.
4 Preferred Security Certifications Preferred (CISSP, CIH, Sec+)

## Description

* Perform advanced incident response across Windows and Linux environments, including triage, containment, eradication, and recovery.
 * Conduct host-based forensics, including log analysis, memory capture, file system review, and malware behavior analysis.
 * Serve as Incident Commander during cybersecurity events, coordinating actions, documenting decisions, and communicating with leadership and affected agencies.
 * Analyze adversary Tactics, Techniques, and Procedures (TTPs) and map findings to MITRE ATT&CK.
 * Review and validate alerts from SIEM, IDS/IPS, EDR, and network monitoring tools.
 * Produce incident reports, timelines, and executive summaries for statewide stakeholders.
 * Support multi-agency response operations, including SLTT partners and critical infrastructure entities.
 * Provide recommendations for detection improvements, hardening, and long-term mitigation.
 * Participate in post-incident reviews, lessons learned, and playbook updates.
 * Maintain readiness for 24x7 response through on-call rotation or surge support.

Candidate must be a U.S. citizen, pass required background checks, complete required cybersecurity, privacy, and operational training before gaining system access, and comply with TXCC security and data-handling requirements. Occasional after-hours support may be required with TXCC approval. Work must be performed from within the United States unless TXCC grants prior written approval.