Security Analyst (Remote)

About the position

The Security Analyst II monitors, investigates, and responds to security events across customer environments. Working with customers and internal security teams, this role supports incident response, investigates threats, and improves detection capabilities and security operations.

Core responsibilities

• Monitor security alerts and events across the security platform and customer environments.
• Analyze and investigate suspicious activity across endpoints, networks, servers, identity systems, cloud environments, and security technologies.
• Perform initial triage to determine the severity, scope, and potential impact of security incidents.
• Escalate confirmed or high-risk incidents to incident response teams or senior security specialists.
• Participate in incident response, including containment and remediation activities.
• Review security telemetry, logs, and alerts to identify malicious or abnormal behavior.
• Document investigations, findings, actions taken, and customer communications accurately.
• Complete daily operational security tasks in line with established processes and service expectations.
• Communicate security findings and recommended actions to customers and internal stakeholders.
• Identify improvements to detection, automation, operational processes, and platform effectiveness.
• Collaborate with managed detection and response, threat hunting, incident response, engineering, and customer success teams.

Required experience and skills

• Experience in a Security Operations Center, Managed Security Service Provider, or Managed Detection and Response environment.
• Experience with SIEM and log-management platforms such as Splunk, Elastic Stack, Microsoft Sentinel, or Google Security Operations.
• Experience with endpoint detection and response tools such as CrowdStrike, Microsoft Defender, or SentinelOne.
• Experience with cloud environments and technologies, including AWS, Microsoft Azure, and Google Cloud Platform.
• Experience supporting Microsoft 365, Entra ID/Azure AD, Proofpoint, or other enterprise security platforms.
• Scripting or development experience with Python, PowerShell, JavaScript, or similar technologies.
• Advanced system administration experience using Windows PowerShell, Ansible, SaltStack, Chef, Puppet, or similar technologies.
• Experience with SOAR platforms such as Cortex XSOAR, Splunk SOAR, or comparable tools.
• Familiarity with incident response, threat hunting, digital forensics, or malware analysis.
• Understanding of the MITRE ATT&CK framework and common adversary behaviors.
• Strong understanding of how networks, endpoints, servers, identity systems, and cloud environments interact.
• Critical thinking, technical curiosity, clear communication, and a customer-focused approach.