Network Security Analyst

The Network Security Analyst will perform advanced cybersecurity monitoring, threat analysis, security-event triage, and incident investigation within a Cybersecurity Operations Center (CSOC). The analyst will continuously monitor security alerts, investigate suspicious activities, identify potential threats, distinguish legitimate incidents from false positives, and coordinate incident-response activities., * Continuously monitor, triage, analyze, and prioritize cybersecurity alerts.

• Investigate suspicious network, endpoint, cloud, email, and user activity.
• Determine incident severity, scope, impact, and risk.
• Validate potential security incidents and distinguish threats from false positives.
• Escalate confirmed threats to Incident Response, Threat Hunting, or SOC Engineering teams.
• Correlate security events across:
• Endpoints
• Firewalls
• IDS/IPS
• Cloud Services
• Authentication Systems
• Threat Intelligence Feeds
• Analyze Indicators of Compromise (IOCs) and Indicators of Attack (IOAs).
• Investigate phishing emails, malware detections, suspicious network traffic, and anomalous user behavior.
• Document investigations, findings, and response activities in case-management systems.
• Assist with containment, eradication, and recovery activities.
• Escalate critical findings to SOC/CSOC leadership.

Additional Responsibilities:

• Tune security alerts and improve threat-detection capabilities.
• Identify and reduce false-positive trends.
• Integrate threat intelligence into SOC monitoring and investigations.
• Review vulnerability-assessment results and remediation priorities.
• Maintain incident-response procedures, playbooks, workflows, and knowledge-base documentation.
• Research emerging cyber threats, attack techniques, and TTPs.
• Support 24x7 cybersecurity operations when required.
• Participate in high-priority incident response outside normal business hours.
• Communicate security findings to technical and non-technical stakeholders., * SIEM platforms:
• Microsoft Sentinel
• Splunk
• NetWitness
• QRadar
• ArcSight
• LogRhythm
• EDR/XDR:
• Microsoft 365 Defender XDR
• Microsoft Defender for Endpoint
• CrowdStrike
• SentinelOne
• IDS/IPS:
• Trellix / FireEye
• Corelight
• Threat Intelligence:
• VirusTotal
• Google Threat Intelligence
• Cisco Talos
• Recorded Future
• MISP
• Vulnerability Management:
• Tenable
• Qualys
• Rapid7
• Email Security:
• IronPort ESA
• Abnormal.ai
• Proofpoint
• Cloud Security:
• Wiz
• Microsoft Defender for Cloud Apps (MDCA)
• Cortex Cloud
• Sysdig
• SASE:
• Zscaler
• Prisma
• Netskope
• Experience operating within a 24x7 SOC/CSOC environment.

Network Security, Security Analysis, Network Performance/Analysis, Security Analysis, Analysis Skills, Network Security, Internet Security, Network Performance/Analysis, Incident Response, Security Monitoring, * Minimum 5%2B years of overall experience in cybersecurity operations, security monitoring, incident response, threat detection, security investigations, or related cybersecurity disciplines.

• Minimum 3%2B years of security alert triage experience.
• Minimum 3%2B years analyzing cybersecurity events.
• Minimum 3%2B years documenting security incident investigations.
• Minimum 3%2B years working with cybersecurity frameworks.
• Minimum 3%2B years with incident-response processes.
• Minimum 3%2B years with threat-detection methodologies.
• Minimum 3%2B years in cybersecurity/SOC operations.
• Minimum 3%2B years of security-monitoring experience.
• Minimum 3%2B years of incident-response experience.
• Minimum 3%2B years of threat-detection experience.
• Minimum 3%2B years conducting security investigations.
• Strong understanding of SIEM, EDR/XDR, IDS/IPS, firewalls, endpoint security, and cloud-security platforms.
• Strong understanding of malware, phishing, insider threats, and APTs.
• Knowledge of MITRE ATT&CK methodologies.
• Knowledge of IOCs, IOAs, and threat intelligence.
• Knowledge of the incident-response lifecycle, NIST Cybersecurity Framework, NIST Incident Response guidance, and PICERL.
• Understanding of Windows, Linux, Active Directory, Microsoft Entra ID, and networking protocols.
• Experience correlating data across multiple cybersecurity platforms.
• Experience with query languages including KQL, SPL, Lucene, and ESQL.
• Experience with scripting languages including PowerShell, Python, and Bash., * Must currently reside in the Austin metropolitan area.
• Must be willing to work 100% onsite in Austin, TX.
• Strong analytical and cybersecurity investigation capabilities.
• Ability to distinguish genuine threats from false positives.
• Strong risk-based decision-making skills.
• Ability to follow incident-response and escalation procedures.
• Ability to work independently and within a 24x7 cybersecurity team.
• Strong written and verbal communication skills.
• Ability to communicate with security engineers, incident responders, system administrators, leadership, and business stakeholders.
• Must be available for occasional evening, weekend, and holiday support during critical security incidents., * Four-year degree in Cybersecurity, Information Security, Computer Science, Computer Information Systems, Management Information Systems, or related field Preferred.
• Relevant education and professional experience may substitute where permitted., * CompTIA Security%2B Preferred
• GIAC Certified Incident Handler (GCIH) Preferred
• GIAC Certified Intrusion Analyst (GCIA) Preferred
• Certified SOC Analyst (CSA) Preferred
• Microsoft Certified: Security Operations Analyst Associate (SC-200) Preferred
• Other GIAC/SOC-related cybersecurity certifications Preferred