Information Security Analyst II

Monitor and triage alerts across SIEM, endpoint detection and response, email security, identity, and cloud security platforms, prioritizing by risk and potential business impact. Investigate suspicious activity to a conclusion, pivoting across multiple telemetry sources to confirm or rule out malicious behavior. Classify observed activity against frameworks such as MITRE ATT&CK to support consistent categorization and trend analysis. Review indicators using threat intelligence and malware analysis tooling to establish reputation and observed behavior. Escalate confirmed or suspected incidents promptly, with a clear summary of what is known, what remains unverified, and recommended next steps. Apply the incident response lifecycle — detection and analysis, containment, eradication, recovery, and post-incident review — to owned incidents. Determine blast radius and reconstruct attack timelines by correlating endpoint, identity, network, and log telemetry. Execute containment actions such as host isolation, account disablement, and indicator blocking. Collect and preserve evidence while maintaining sound chain of custody. Support the incident response lead on P1 incidents by providing scoping, evidence, and timeline reconstruction. Partner with ThreatOps, SecOps Engineering, IT, and application teams to validate findings and coordinate remediation. Tune detection logic to reduce false positives, documenting rationale and risk accepted for every suppression or threshold change. Track recurring alert patterns and identify candidates for automation. Maintain and improve triage runbooks so investigative steps are repeatable across the team. Participate in tabletop exercises and response drills to build and maintain readiness. 1+ year in an information security analyst or SOC analyst role. 3+ years of experience in a technology role. Bachelor's degree in information assurance, computer science, or a related field, or equivalent experience. Hands-on experience with a SIEM, including log search, correlation, and alert triage across large structured and unstructured data sets. Working knowledge of endpoint detection and response tooling and the investigative workflow it supports. Proficiency in operating systems (Windows, macOS, Linux/Unix, mobile) and core network theory, including common protocols and basic traffic analysis. Ability to read and interpret scripts, and to write basic scripts or queries in support of an investigation. Familiarity with common attacker techniques and a recognized classification framework such as MITRE ATT&CK. Working understanding of the incident response lifecycle and the ability to apply it to live incidents. Schedule flexibility — available to work outside standard business hours, including evenings, weekends, and holidays, as incident severity and volume demand. About Us.