Network Security Analyst

Job Description — Network Security Analyst

Location: Austin, TX — 100% Onsite / Local Candidates Only

Client: Texas Health and Human Services Commission (HHSC)

Role Summary:

The Network Security Analyst will work within the Cybersecurity Operations Center (CSOC/SOC) performing security monitoring, alert triage, threat detection, security investigations, and incident response activities. The analyst will investigate suspicious activity, identify potential threats, correlate security events, and escalate confirmed incidents.

Key Responsibilities:

Monitor and triage cybersecurity alerts from SIEM, EDR/XDR, cloud security, email security, identity, and network security platforms.

Analyze security events and determine severity, scope, impact, and risk.

Investigate IOCs, IOAs, phishing, malware, anomalous activity, and suspicious network behavior.

Correlate events from EDR, firewalls, IDS/IPS, cloud services, authentication systems, and threat intelligence feeds.

Support incident containment, eradication, recovery, and escalation.

Perform vulnerability assessment reviews and remediation prioritization.

Document investigations, findings, response actions, and incident reports.

Support alert tuning, threat intelligence integration, playbooks, workflows, and SOC process improvements.

Research emerging cyber threats, attack techniques, tactics, and procedures.

Required Skills

Must-have:

5+ years cybersecurity operations / security monitoring / incident response / threat detection / security investigations.

Security alert triage and security event analysis.

Incident investigation and documentation.

Incident response processes.

Threat detection methodologies.

Cybersecurity frameworks such as NIST CSF / NIST Incident Response / PICERL.

Experience with one or more SIEM platforms:

Splunk

Microsoft Sentinel

QRadar

ArcSight

NetWitness

LogRhythm

EDR/XDR: Microsoft Defender, CrowdStrike, SentinelOne, etc.

IDS/IPS and firewall technologies.

Threat intelligence and IOC analysis.

Vulnerability management.

Knowledge of KQL, Lucene, SPL, ESQL, etc.

Scripting with PowerShell, Python, or Bash.

Preferred Certifications:

Security+, GCIH, GCIA, Certified SOC Analyst, Microsoft SC-200, or other GIAC/SOC certifications