Security Analyst

Job Summary


Responsibilities

• Monitor security telemetry from SIEM (Splunk, Sentinel, etc.), EDR/MDR, CSPM, and cloud-native sources to detect suspicious activity.
• Triage, investigate, and respond to security incidents in real time using documented playbooks; conduct root cause analysis and ensure proper containment/remediation.
• Build and tune detection rules, dashboards, and alerts - reduce false positives while improving true positive coverage.
• Perform vulnerability scans, coordinate remediation with DevOps/Cloud Ops, and track closure.
• Maintain and improve incident response playbooks, runbooks, escalation matrices, and evidence trails for audits.
• Integrate threat intelligence feeds into detection logic and perform basic threat hunting (hypothesis -> query -> detection).
• Automate repetitive tasks and alert enrichment using Python, Bash, or PowerShell; centralize alerting across tools.
• Support compliance evidence collection (SOC 2, ISO 27001, CIS) and assist during audits.
• Plan and execute controlled offensive engagements: web app, network, cloud, and AD-focused assessments (scoping and safety-first execution).
• Perform reconnaissance, vulnerability discovery, exploit validation, and privilege escalation in target environments (on-prem and cloud).
• Create and run realistic attack paths and adversary emulations using frameworks (MITRE ATTCK mapping).
• Develop and refine custom PoCs, scripts and small tools (Python, Bash); adapt open-source tools safely.
• Work with Blue/Defensive teams to validate detections and tune alerts - provide actionable remediation steps and detection opportunities.
• Produce clear, prioritized technical reports and executive summaries that include remediation and detection recommendations.
• Contribute to red team playbooks, threat libraries, and runbooks; maintain safe testing checklists and rules-of-engagement.
• Assist with tabletop exercises and purple-team sessions; demonstrate attack techniques during training.

Requirements

• Log analysis (Windows + Linux)
• Basic incident detection and response
• Networking basics (TCP/IP, DNS, HTTP/HTTPS)
• SIEM basics (alert checking and triage)
• Understanding of common attacks (phishing, malware, brute force)
• Basic Windows and Linux usage
• Basic knowledge of firewalls and antivirus
• Web Application Penetration Testing
• Mobile Application Security Testing (Android/iOS)
• API Security Testing
• Network Penetration Testing
• Vulnerability Assessment
• Knowledge of OWASP Top 10 OWASP API Security Top 10
• Experience with Linux Windows Environments
• Strong Understanding of TCP/IP, HTTP/HTTPS, DNS, and SSL/TLS
• Proficiency with Burp Suite, Nmap, Wireshark, and Metasploit
• Basic Scripting Skills (Python, Bash, or PowerShell)
• Technical Report Writing Documentation

Certifications

• Security+
• CEH (optional)
• PenTest+
• OSCP
• CySA+
• SC-200
• SecurityX (CASP+)

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.