Security Analyst

Job Title: Security Analyst - Project Lead

Work Location

Columbia, South Carolina

Work Arrangement: Onsite preferred, followed by hybrid and remote (with onsite availability as needed).

Job Responsibilities

• Monitor and analyze security alerts from SIEM, EDR, IDS/IPS, and threat intelligence tools to identify potential security threats and attacks.
• Investigate security incidents, determine root causes and impacts, and escalate critical incidents when necessary.
• Prepare incident reports, investigation timelines, and post-incident summaries with recommendations for remediation.
• Investigate phishing emails, malware infections, and security policy violations, and recommend appropriate response actions.
• Improve SOC playbooks, detection rules, alert thresholds, and workflows to reduce false positives and strengthen threat detection.
• Collaborate with engineering and SOC teams to configure monitoring tools, integrate threat intelligence feeds, and perform proactive threat hunting.
• Use the MITRE ATT&CK framework to identify and investigate potential threats and attack techniques.
• Document SOC procedures, troubleshooting steps, and operational guidelines.
• Work with agency staff, engineering teams, and other stakeholders to resolve security issues and improve service delivery.
• Explain security services and capabilities to customers and assist with technical issues.

Required Skills

• Minimum 2 years of experience in security monitoring and incident response.
• Minimum 2 years of experience working with the MITRE ATT&CK framework.
• Minimum 2 years of experience creating dashboards and security reports.

Preferred Skills

• Experience with Palo Alto Cortex XSIAM/XDR.
• Knowledge of Linux, network administration, and network design.
• Experience managing firewalls, VPNs, Active Directory, and Intrusion Detection/Prevention Systems (IDS/IPS).
• Candidates local to Columbia, SC, or surrounding areas are preferred.

Education and Experience

• Associate's degree in Information Technology, Information Security, or a related field.
• Four years of relevant work experience may substitute for the educational requirement.
• Minimum 2 years of experience supporting large-scale Security Operations Center (SOC) environments.

Preferred Certifications

• CISSP, CISA, CISO, or equivalent advanced security certifications.
• CEH, OSCP, GPEN, or other relevant cybersecurity certifications.
• Vendor-specific information security certifications.

Interview Process

• Initial interview via Microsoft Teams with the camera on.
• In-person interview preferred before final selection.