Security Analyst

The Incident Response Contractor will augment the Security Operations team’s incident response capabilities by providing hands-on investigation, incident scoping, containment, and remediation support across the enterprise. This role will increase response capacity, reduce the time required to investigate and contain security incidents, and improve the team’s ability to manage concurrent investigations. The contractor will work closely with Security Operations, Security Engineering, and other technical teams to drive incidents from initial triage through containment, remediation, and closure., Triage and investigate security alerts and suspected incidents across endpoint, identity, email, network, and cloud environments. Scope incidents, assess severity and business impact, identify affected assets and accounts, and coordinate appropriate containment and remediation actions. Conduct endpoint investigations and containment using CrowdStrike Falcon or comparable EDR technology, including analysis of endpoint telemetry, suspicious processes, persistence mechanisms, and indicators of compromise. Correlate security events and investigate suspicious activity using Splunk or comparable SIEM and security analytics platforms. Collaborate with ReliaQuest GreyMatter and the managed detection and response function to investigate escalations, validate findings, and coordinate response activities. Investigate phishing, malicious email, and related threats using Proofpoint and available email-security telemetry. Use ThreatLocker telemetry to investigate suspicious application execution, unauthorized activity, and potential endpoint compromise. Analyze network-related activity using available telemetry from Palo Alto Networks, Check Point, Cisco SSE/Umbrella, Cloudflare, Vectra AI, and comparable technologies, as applicable. Support identity-related investigations involving Microsoft identity technologies, CyberArk, Entro, Duo, and CrowdStrike identity capabilities, as applicable. Develop incident timelines, correlate indicators of compromise, determine potential attack paths, and document investigative findings. Coordinate containment and remediation with Security Engineering, Infrastructure, Identity and Access Management (IAM), Network Engineering, and other stakeholders. Validate remediation effectiveness and identify outstanding risks before incident closure. Participate in threat hunting, post-incident reviews, detection tuning, and incident response playbook improvements. Maintain clear incident records documenting findings, decisions, actions taken, and follow-up requirements.

Hands-on experience in incident response, digital forensics and incident response (DFIR), SOC operations, or threat detection and investigation. Experience using an enterprise EDR platform to investigate and respond to security incidents. Experience using a SIEM or security analytics platform to correlate events and investigate suspicious activity. Experience with incident triage, scoping, containment, remediation, and technical documentation. Strong analytical, troubleshooting, and communication skills. Ability to work independently while collaborating effectively with internal technical teams and external security providers. Preferred Hands-on experience with CrowdStrike Falcon and Splunk. Familiarity with ReliaQuest GreyMatter or another managed detection and response (MDR) platform. Experience with Proofpoint or comparable email-security technologies. Experience investigating identity compromise, phishing, endpoint compromise, network intrusions, or cloud security incidents. Familiarity with ThreatLocker, network detection and response tools, and enterprise identity security technologies.