Security Analyst

InterSources Inc is recruiting for a confidential client. The Security Analyst – Project Lead will support SOC operations by monitoring and investigating security events, hunting threats, improving detection and response processes, and coordinating incident response with internal teams and state agencies.

Responsibilities:

• Monitor and correlate security events across SIEM, EDR, IDS/IPS, and threat intelligence platforms to identify suspicious activity and emerging threats
• Investigate security incidents, analyze attack patterns, determine root causes, assess impact, and escalate critical incidents to Tier 3 teams
• Conduct investigations involving phishing, malware, unauthorized access, and potential security policy violations
• Perform proactive threat hunting using threat intelligence, indicators of compromise (IOCs), and MITRE ATT&CK tactics, techniques, and procedures (TTPs)
• Create and maintain security dashboards, incident reports, investigation timelines, and post-incident documentation
• Fine-tune SIEM detection rules, alert thresholds, and correlation logic to reduce false positives and improve threat detection
• Develop and update SOC playbooks, incident response procedures, runbooks, and troubleshooting documentation
• Collaborate with security engineering teams to optimize monitoring tools and integrate threat intelligence feeds
• Coordinate incident containment, remediation, recovery, and preventative security measures with internal teams and state agencies
• Serve as a security subject matter expert (SME), supporting agency stakeholders and promoting centralized security services

Requirements:

• 2+ years of experience in Security Monitoring and Incident Response
• 2+ years of hands-on experience applying the MITRE ATT&CK framework
• 2+ years of experience creating security dashboards and reports
• 2+ years of experience supporting large-scale Security Operations Center (SOC) operations
• Associate's degree in Information Technology, Information Security, or a related field. Four years of relevant work experience may substitute for the degree requirement
• Experience with Palo Alto Cortex XSIAM/XDR platforms
• Knowledge of Linux administration, network administration, and network design
• Experience administering firewalls, VPNs, Active Directory, and IDS/IPS solutions
• Advanced security certifications such as CISSP, CISA, CISO, or equivalent
• Additional cybersecurity certifications such as CEH, OSCP, or GPEN
• Vendor-specific information security certifications