Information Security Analyst

About the role

The Information Security Analyst is a technical role within the Information Security (InfoSec) group of Information Technology Services (ITS), responsible for defending the client's data assets through policy controls, security operations, incident response, and AI-assisted tooling. As a primary network defender, the analyst works at the intersection of threat detection, vulnerability management, and forensic investigation within a Security Operations Center (SOC). The role requires hands-on experience across several domains: SOC operations including alert triage, log analysis, and network traffic interpretation using tools such as Splunk, Kibana, or Microsoft Sentinel; Python 3 scripting for automation and detection support; firewall management for ruleset maintenance and network security enforcement; Microsoft Entra ID administration including identity architecture and PowerShell scripting; Linux system administration across mixed-OS environments; and digital forensics at a first-responder level, including breach assessment, evidence preservation, and containment. This role is responsible for developing and overseeing student SOC employees. The SOC functions as both a live security operation and a learning environment, requiring the analyst to serve as practitioner and mentor.

Responsibilities

• Operate, tune, and recommend enhancements to the SOCs monitoring and detection platforms including Microsoft Defender and SIEM tools; leverage AI-assisted tooling to improve detection and response workflows.
• Implement threat hunting and detection strategies; identify new data sources to augment detection capability; integrate new tools and applications as needed.
• Write Python and PowerShell scripts to automate detection, response, and data analysis workflows.
• Assist in maintenance of firewall rulesets.
• Serve as first responder for security incident investigation, conducting log and system-level analysis to determine potential scope and impact.
• Assist with containment, eradication, and recovery efforts.
• Perform digital forensic analysis at the first-responder level to determine whether a breach has occurred and what steps are required to contain it.
• Provide written and verbal summaries of incident findings to be shared with ITS leadership and relevant stakeholders.
• Assist in maintaining and operating the Universitys vulnerability assessment program, including scan configuration, finding analysis, risk prioritization based on exploitability and business impact, and remediation coordination with system owners.
• Track patching effectiveness and validate closure of critical findings.
• Assist in the hiring, continuous training, mentoring, and operational oversight of student SOC employees.
• Develop and maintain the SOC processes, runbooks, and escalation procedures that student analysts follow.
• Provide direct coaching on alert investigation techniques, log analysis, and documentation standards.

Requirements

• Windows/Active Directory, endpoint log analysis, PowerShell, and group policies (1+ years experience)
• Linux system administration (1+ years experience)
• Digital forensics at a first-responder level (1+ years experience)
• AI-assisted security tools (e.g., Copilot, AI-enhanced SIEM) (1+ years experience)
• Intermediate experience level

Skills

• Security
• Information security
• Cyber security
• Risk management