Maintain awareness of ticket queues and ensure service levels are met.
Security Investigations
Investigate suspicious activity, security alerts, and user-reported concerns.
Perform account compromise, phishing, identity, endpoint, and access-related investigations.
Gather and analyze evidence from security tools and platforms.
Escalate complex incidents when appropriate.
Support incident response activities during security events.
Operational Process Execution
Execute established security procedures and playbooks.
Support user access reviews, security assessments, and operational security tasks.
Coordinate with IT and business stakeholders to resolve operational issues.
Maintain accurate operational documentation and procedures.
Identify recurring issues and recommend process improvements.
Security Platform Operations
Utilize security tools to investigate and respond to operational events.
Support monitoring and administration of cybersecurity technologies.
Validate security alerts and determine appropriate actions.
Assist with security control testing and operational validation activities.
Automation and Continuous Improvement (20%)
Workflow Automation
Identify repetitive and time-consuming operational tasks suitable for automation.
Develop, test, and maintain SOAR workflows and automation playbooks.
Improve consistency and repeatability of operational procedures.
Process Optimization
Analyze ticket trends and operational metrics.
Recommend improvements that reduce manual effort and increase efficiency.
Develop documentation for automated workflows and processes.
Measure automation effectiveness and operational benefits.
Required Qualifications
Education
Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related discipline; or equivalent combination of education and experience.
Experience
5+ years of experience in cybersecurity operations, incident response, security engineering, or a related field.
5+ years of experience investigating cybersecurity events and security alerts.
5+ years of experience working within a ticket-driven operational environment.
5+ years of experience supporting security technologies and operational processes.
2+ years of experience with scripting, automation, or workflow orchestration platforms preferred.
Technical Skills
Experience with all of the following
Security Operations Center (SOC) processes
Incident Response
Identity and Access Management
Microsoft 365 Security
Okta
Endpoint Detection and Response (EDR/XDR)
SIEM platforms
Email Security
Cloud Security (Azure/AWS)
ServiceNow, Jira, or similar ticketing platforms
Security investigation and threat analysis
SOAR platforms such as Tines, Cortex XSOAR, Splunk SOAR, or Microsoft Sentinel Automation
PowerShell, Python, JavaScript, or similar scripting languages
Key Performance Indicators
Timely handling and resolution of operational tickets.
Quality and completeness of investigations.
Adherence to operational procedures and service levels.
Reduction in manual effort through automation.
Number and effectiveness of implemented workflow improvements.
Accuracy and quality of documentation.
Contribution to overall team efficiency and scalability.
Characteristics of a Successful Candidate
Strong operational mindset with attention to detail.
Comfortable managing a high volume of tickets and investigations.
Naturally curious and investigative.
Able to independently prioritize and execute work.
Process-oriented and focused on continuous improvement.
Practical experience automating repetitive tasks.
Effective collaborator in a small, fast-moving team environment.
