Network Security Analyst 2

Mandatory Skills:

1. Minimum of seven years of experience in cybersecurity, network security, security operations, incident response, or a closely related information security role.
2. Hands-on experience with Microsoft Sentinel, including incident management, analytics rules, workbooks, automation, data connectors, and Kusto Query Language.
3. Experience using SIEM for log analysis, alert investigation, dashboarding, correlation searches, and security monitoring.
4. Experience with NDR for network traffic analysis, packet/session investigation, threat detection, and incident support.
5. Experience with EDR tools, including endpoint alert triage, device investigation, advanced hunting, and response actions.
6. Working knowledge of network security concepts, including firewalls, IDS/IPS, proxy logs, DNS, VPN, TCP/IP, segmentation, and secure network architecture.
7. Ability to analyze complex security events, correlate data across multiple sources, and produce clear written documentation and recommendations.
8. Knowledge of security frameworks, standards, and regulatory considerations such as NIST, CIS Controls, HIPAA, and state information security requirements.
9. Strong communication, collaboration, problem-solving, and analytical skills.
10. 7 years of Knowledge of SIEM, SOAR, EDR, XDR, NDR
11. 7 years of Experience with security log collection and management
12. 7 years of Experience with threat intelligence concepts
13. 7 years of Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting
14. 7 years of Experience in SIEM platform/architecture support
15. 7 years of Experience in detection engineering methodology and implementation

Desirable Skills:

1. Bachelor's degree in cybersecurity, computer science, information systems, information technology, or a related field. Relevant experience may be considered in place of education where applicable.
2. Microsoft security certifications are strongly preferred, such as Microsoft Certified: Security Operations Analyst Associate, Microsoft Certified: Cybersecurity Architect Expert, Microsoft Certified: Azure Security Engineer Associate, or Microsoft 365 Defender-related certifications.
3. Additional preferred certifications include CompTIA Security+, CySA+, GIAC security certifications, CISSP, CISM, CISA, Splunk Core Certified Power User, Splunk Enterprise Security Certified Admin, or SentinelOne product certifications.
4. 10 years of Knowledge of SIEM, SOAR, EDR, XDR, NDR
5. 10 years of Experience with security log collection and management
6. 10 years of Experience with threat intelligence concepts
7. 10 years of Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting
8. 10 years of Experience in SIEM platform/architecture support
9. 10 years of Experience in detection engineering methodology and implementation

Knowledge, Skills, and Abilities

• Knowledge of SIEM, SOAR, EDR, XDR, network detection and response, log management, and threat intelligence concepts.
• Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting.
• Skill in identifying indicators of compromise, attacker tactics, suspicious network patterns, and endpoint-based threats.
• Ability to prioritize alerts, document investigative steps, and escalate incidents based on severity and business impact.
• Ability to work independently and collaboratively in a security operations environment with shifting priorities and time-sensitive incidents.
• Ability to communicate cybersecurity risks, findings, and recommended actions to both technical and non-technical audiences.