> Markdown version of [/jobs/ext/523408-information-security-analyst](https://www.wearedevelopers.com/jobs/ext/523408-information-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Analyst - **Company:** Carco Group, Inc. - **Location:** Annapolis, MD, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Microsoft Azure, Cloud Computing Security, CompTIA Security+, Cyber Security, Python (Programming Language), Network Monitoring, Windows PowerShell, Security Information and Event Management, Software Vulnerability Management, Scripting, Mitre Att&ck, Tenable Nessus, Microsoft Sentinel, RSA Archer Platform, Splunk, Qualys, Servicenow - **Published:** June 13, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=0f31cac14623e83a ## About the Role Do you have experience in Vuls?, + 3-5 years of experience in an information security role with exposure to both technical operations and compliance functions + Hands-on experience with SIEM platforms (Splunk, Microsoft Sentinel, or equivalent) + Working knowledge of vulnerability management tools such as Tenable Nessus/IO or Qualys + Demonstrated understanding of SOC 2 Trust Service Criteria and NIST Cybersecurity Framework + Familiarity with common attack techniques and defensive countermeasures (MITRE ATT&CK familiarity a plus) + Strong analytical and problem-solving skills with the ability to work both independently and collaboratively + Excellent written and verbal communication skills; ability to translate technical findings for non-technical audiences Preferred + Relevant certifications such as CompTIA Security+, CySA+, CEH, CISM, or equivalent + Experience supporting a SOC 2 audit from end to end + Scripting or automation skills (Python, PowerShell) for security tooling and reporting + Exposure to cloud security (AWS, Azure, or GCP) environments + Experience working with GRC platforms (e.g., Archer, ServiceNow GRC, Drata, Vanta) ## Description + Monitor, tune, and triage alerts across the SIEM platform, escalating confirmed incidents per established runbooks + Manage the vulnerability management lifecycle- including scanning, prioritization, remediation tracking, and executive reporting + Support endpoint security, email security, and network monitoring tools; identify gaps and recommend configuration improvements + Conduct periodic threat hunting activities and contribute to the development of detection rules and playbooks + Participate in incident response activities including containment, eradication, and post-incident reviews Governance, Risk & Compliance (GRC) + Support ongoing SOC 2 Type II compliance efforts, including evidence collection, control testing, and coordination with external auditors + Assist with NIST CSF assessments - mapping current controls to framework functions and identifying gaps for remediation + Maintain and update security policies, standards, and procedures in collaboration with senior team members + Conduct periodic security risk assessments and contribute findings to the organization risk register + Track remediation efforts for identified risks and control deficiencies through to closure Collaboration & Communication + Partner with IT, Engineering, and business stakeholders to embed security best practices into day-to-day operations + Assist in security awareness initiatives and provide guidance to staff on security topics + Prepare clear, concise reporting on security metrics, vulnerability status, and compliance posture for management ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) - [Oops! Stories of supply chain shenanigans](https://www.wearedevelopers.com/videos/245-oops-stories-of-supply-chain-shenanigans) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)