IT Security Analyst (USI5)

Responsibilities

• Own the triage and investigation of all security alerts and incidents in alignment with VSE’s Incident Response (IR) framework, serving as the primary responder and escalation point in coordination with VSE’s managed SOC partner.
• Perform advanced analysis of security alerts from multiple sources to identify true positives, detect emerging threats, and recommend containment and remediation strategies.
• Serve as the primary point of contact for escalated incidents from Tier I analysts and managed SOC partners.
• Own and continuously improve the incident response playbooks, ensuring procedures evolve with threat intelligence and adversarial trends.
• Develop and implement SIEM use cases, correlation rules, and dashboards to improve detection accuracy and operational efficiency.
• Manage and maintain endpoint, email, and cloud security platforms — ensuring configurations, policies, and rules are optimized for evolving threats.
• Conduct phishing simulations and user behavior analysis; lead targeted awareness campaigns for high-risk groups.
• Perform root cause analysis for recurring incidents and propose technical or procedural remediation plans.
• Collaborate closely with Network, Infrastructure, and Cloud teams to harden environments and ensure consistent enforcement of security controls.
• Support security audits, penetration testing activities, and red/blue/purple team exercises — driving follow-up actions to closure.
• Generate metrics, reports, and trend analysis to inform leadership and support continuous improvement initiatives.
• Act as the technical lead for specific security domains (e.g., SOAR/SIEM operations, incident response).
• Guide team members in threat analysis and incident handling.
• Contribute to policy and process development, ensuring alignment with regulatory frameworks and industry best practices.
• Lead post-incident reviews and lessons-learned sessions to improve detection and response maturity.

Qualifications

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field.
• Minimum 5 years of relevant IT Security experience, including at least 2 years of experience in an incident response role.
• Proven ability to analyze complex security alerts and incidents, and develop effective containment and remediation strategies.
• Experience with SIEM tools, such as Splunk, QRadar, or ArcSight, and familiarity with common log formats like Syslog, CSV, and JSON.
• Strong understanding of network architecture, operating systems, and cloud services (AWS, Azure, GCP).
• Experience with endpoint protection solutions (e.g., CrowdStrike, Carbon Black), email security (e.g., Proofpoint), and cloud security (e.g., Okta, Azure AD).
• Excellent communication and interpersonal skills, with the ability to work effectively with cross-functional teams and stakeholders.
• Ability to prioritize tasks, manage competing priorities, and meet deadlines under pressure.
• Knowledge of regulatory frameworks (e.g., GDPR, HIPAA) and industry best practices in cybersecurity.