Cyber Security Analyst

Cyber Security Analyst

The Cybersecurity Analyst is a member of the Cybersecurity department, supporting the newly formed Amwins Australasia Division. The analyst serves as the first line of defense in security event monitoring, working to detect and mitigate threats to the organization. Using Microsoft Defender XDR and other security tools, the analyst monitors for security events, responds to security related service requests from users, and conducts in depth analysis of logs and security alerts to identify potential threats.

The Analyst works closely with internal teams to ensure effective containment and eradication, helps build repeatable security processes within the Security team, and assists with projects and tasks as directed. Most importantly, they build relationships to increase the security mindset of the organization through collaboration.

This role is built for someone with a natural curiosity and a genuine passion for cybersecurity: a person who keeps learning as threats, tools, and techniques evolve, including how AI can make detection and response faster and more effective.

Responsibilities

• Monitor, triage, and respond to security events and alerts using Microsoft Defender XDR and related security tools, serving as the first line of defense against security threats.
• Conduct in-depth analysis of logs, network traffic, and security alerts to identify potential threats, using Kusto Query Language (KQL) for investigation and proactive threat hunting.
• Apply AI-assisted capabilities to accelerate alert triage, investigation, enrichment, and response, validating AI-generated output.
• Facilitate security event response and containment during a Security Incident and coordinate response and recovery efforts with other members of the team and internal partners to ensure effective containment and eradication.
• Respond to and resolve security related service requests from users.
• Escalate identified risk to the Technology Risk and Compliance program as well as Senior Management.
• Make recommendations to enhance the effectiveness of controls.
• Create and update process documentation as needed and assist with the creation of security processes to establish repeatable practices within the Security team.
• Create reporting, as directed, to ensure effective security operations.
• Stay current on emerging threats, adversary techniques, and security tooling, and share what is learned with the team to continuously improve detection and response.
• Maintain well documented cases for case/shift handoff to support a follow-the-sun operating model.

Qualifications, Skills, and Experience

• Experience: 2–3 years of minimum experience in a security operations, incident response, or related IT role.
• Technical Skills: Hands-on experience with Microsoft Defender XDR (Endpoint, Identity, Cloud Apps) and Microsoft Sentinel; working proficiency in KQL and advanced hunting; understanding of the incident response lifecycle, MITRE ATT&CK, SIEM and XDR concepts, Windows and Active Directory/Entra ID, networking fundamentals, and cloud security. Scripting or automation experience (PowerShell, Python) is a plus.
• Bias for Action: Moves quickly from alert to action, making sound decisions with the judgment to know when to escalate
• AI in Security Operations: Working knowledge of applying generative AI and AI-assisted tools to security operations, such as alert triage, query development, incident summarization, and enrichment, with the judgment to validate outputs.
• Curiosity and Passion: A natural curiosity and genuine passion for cybersecurity, demonstrated through self-driven learning such as maintaining a home lab and participating in CTF events with a desire to understand how and why attacks work.
• Communication and Collaboration: Clear written and verbal communication, including disciplined case documentation and shift handoff. The ability to document processes and escalate risk effectively. Comfort collaborating across time zones in a follow the sun team.