Security Analyst – Shift Lead

Role Summary
This position involves advanced security intrusion detection and cybersecurity analysis, focusing on log examination, event review, and security monitoring. The role requires senior-level expertise in managing security operations, leading shift teams, and utilizing SIEM tools to identify and analyze security threats. The candidate will leverage their experience to enhance threat detection capabilities and support compliance efforts within a dynamic security environment.

Responsibilities

• Lead and oversee cybersecurity shift operations, ensuring effective monitoring and incident response.
• Analyze logs from various sources, including web servers, raw data logs, and network traffic, to identify security threats.
• Develop and execute advanced queries using Splunk SIEM or similar tools for threat detection and analysis.
• Review and interpret Snort-based IDS events, firewall ACLs, and Pcaps to assess security posture.
• Conduct thorough web log reviews and analyze console events to inform security decisions.
• Collaborate with security teams to develop improved detection strategies and techniques.
• Maintain and update SIEM configurations, dashboards, and alerting rules to optimize threat detection.
• Lead investigations into security incidents, documenting findings, and recommending corrective actions.
• Stay current with cybersecurity trends, emerging threats, and updates to security technologies and protocols.
• Support compliance and audit activities related to security monitoring and incident management.

Qualifications

• Minimum of seven years of security intrusion detection experience, including extensive use of logging technologies.
• At least two years as a cybersecurity or security operations shift team leader.
• A minimum of five years performing analytics examination of logs and console events at a senior level.
• Proven skills in advanced query development in Splunk or GREP, firewall review, IDS event analysis, and web log review.
• Demonstrated experience working in a SIEM environment with tools such as Splunk.
• Bachelor’s Degree in Information Systems, Computer Science, or a related field (preferred).
• Possession of at least one recognized cybersecurity certification, such as GCIA, ECSA, GPPA, GCED, SSCP, or CISSP.
• Splunk Fundamentals I & II certification is required.
• This position requires eligibility for a U.S. Government security clearance. In accordance with federal law, U.S. citizenship is required.

Publishing Pay Range: $50.00 – $55.00 USD Hourly

This position offers a hybrid schedule, with time split between the office and remote work.