Security Analyst Level II

The Information Security Analyst II is a mid-level security professional responsible for monitoring, investigating, and responding to routine and moderately complex cybersecurity events across DBM Global. The role protects company systems and data by operating security technologies, coordinating incident containment and remediation, assessing security risk, and supporting compliance activities, including IT general controls for Sarbanes-Oxley (SOX).

This position works independently within established procedures, exercises sound judgment when evidence is incomplete, escalates high-impact or complex matters promptly, and helps improve detection, response, and preventive controls. The analyst also provides practical guidance to Level I analysts and partners with Infrastructure, Applications, and business teams to reduce risk.

Responsibilities

• Monitor security alerts and events across networks, endpoints, identities, email, cloud services, applications, and other enterprise systems; distinguish actionable threats from benign activity.
• Independently investigate routine and moderately complex incidents; determine scope, business impact, likely cause, affected assets, and required response actions.
• Coordinate containment, eradication, recovery, and remediation with Infrastructure, Applications, service providers, and other stakeholders; escalate significant incidents in accordance with the incident response plan.
• Create complete, timely incident records that capture evidence, analysis, decisions, response actions, root cause when determinable, lessons learned, and remediation recommendations.
• Operate and monitor security technologies such as SIEM, EDR/endpoint protection, email security, firewalls, proxies, identity security, intrusion detection/prevention, vulnerability management, and encryption solutions.
• Identify recurring alerts, false positives, detection gaps, and control weaknesses; recommend and help implement tuning, automation, playbook, and process improvements.
• Create, test, and maintain incident response procedures, investigation guides, and security playbooks.
• Perform assigned vulnerability reviews, third-party security assessments, and operational security assessments; track findings and coordinate remediation to closure.
• Support internal and external audits, SOX IT general control testing, evidence collection, and remediation of identified control deficiencies.
• Review privileged or security-administrator activity, access, and control operation as assigned; report exceptions and support corrective action.
• Maintain and help improve information security policies, standards, metrics, and management reporting.
• Provide technical guidance and case support to Level I Security Analysts; share knowledge and reinforce consistent investigation practices.
• Maintain awareness of relevant threats, vulnerabilities, technologies, frameworks, and regulatory or industry developments.

Measure of Success

• Security alerts and incidents are triaged, investigated, documented, and escalated within established service levels.
• Incident records and audit evidence are accurate, complete, and usable by technical, compliance, and management stakeholders.
• Assigned vulnerabilities, audit findings, and third-party risks are tracked transparently and remediated within agreed timelines.
• Detection quality and response efficiency improve through measurable reductions in avoidable noise, repeat issues, and process gaps.
• Cross-functional partners receive clear, actionable guidance and Level I analysts demonstrate improved consistency and capability.

• Three to five years of progressively responsible experience in information security, cybersecurity, security operations, infrastructure security, or a related technical field.
• Bachelor’s degree in computer science, cybersecurity, information systems, or a related field, or an equivalent combination of education, training, and relevant experience.
• Demonstrated experience investigating security alerts and incidents and coordinating response with technical teams.

Technical Knowledge

• Working knowledge of SIEM, endpoint security/EDR, email security, identity and access management, network security, vulnerability management, and incident response.
• Ability to interpret security logs, correlate evidence across multiple sources, assess impact, and form defensible conclusions with incomplete information.
• Understanding of common attack techniques, security control concepts, investigation methods, and remediation practices.
• Familiarity with security and control frameworks such as NIST Cybersecurity Framework, NIST 800-53, CIS Controls, or equivalent, and with audit/compliance evidence practices.
• Proficiency with Microsoft Windows 11 and Microsoft 365 applications, including Word, Excel, PowerPoint, Teams, and Outlook.

Certification

• Current ISC2 Certified in Cybersecurity (CC) certification, or ability to obtain it within six months of hire or promotion into the role.
• An intermediate certification such as CompTIA Security+, CySA+, ISC2 SSCP, a Microsoft security certification, or an equivalent credential is preferred.

Core Capabilities

• Integrity and discretion - handles sensitive information responsibly, communicates candidly, and earns trust.
• Analytical problem-solving - applies disciplined reasoning, tests assumptions, and looks beyond the first explanation.
• Judgment and prioritization - makes timely, risk-based decisions and recognizes when escalation is required.
• Communication and collaboration - translates technical findings into clear business impact and works effectively across teams.
• Process discipline - follows established controls, maintains high-quality records, and improves repeatable workflows.
• Learning agility and resilience - stays current, adapts to changing threats and technologies, and persists through complex investigations.