Cybersecurity Incident Response Triage Analyst

Role overview Triage cybersecurity alerts and notifications as part of an incident response team working on a shift. The analyst investigates events from monitoring tools and other reporting channels, determines their scope and credibility, and coordinates with response and operations colleagues to support effective incident handling.

Responsibilities - Monitor alerts and respond to suspected security incidents, including policy violations. - Investigate events to establish their nature, scope, and whether they are true or false positives. - Coordinate findings and response activity with team leads and other incident response groups. - Record incidents and investigative actions clearly and in detail. - Work with operations, legal, human resources, and management colleagues on investigations, including interviews where needed. - Help refine response procedures and stay informed about emerging threats.

Requirements - U.S. citizenship. - One to two years of information security experience, or an equivalent combination of education and relevant work. - At least one year analyzing security events and logs using tools such as antivirus, intrusion detection, firewalls, directory services, web proxies, data loss prevention, or SIEM systems. - Familiarity with network and host security tools, TCP/IP and common application protocols, and packet analysis. - Understanding of attack and compromise indicators, malware analysis concepts, and Windows or Linux endpoint analysis. - Strong written and verbal communication, attention to detail, and interpersonal skills; familiarity with basic parsing tools such as spreadsheets, command-line text utilities, and regular expressions.

Nice to have GIAC security certifications such as GCED, GCLD, GCIH, GCFA, or GREM are a plus.