Security Analyst, MXDR

About the role

Cybersecurity for the public good. At nuHarbor, we help organizations navigate an increasingly complex cybersecurity landscape with confidence. By combining expert guidance, innovative technology, and trusted partnerships, we make security stronger, more effective, and easier to understand. We're looking for talented individuals who are passionate about solving meaningful challenges, helping clients succeed, and continuously improving alongside a team that values curiosity, collaboration, and impact.

The Security Analyst, MxDR, is a core member of nuHarbor’s MxDR delivery team, responsible for the full-lifecycle triage, investigation, and disposition of security alerts and incidents across our supported MxDR environments. The Analyst drives each case to a defensible, evidence-based disposition, escalating per defined criteria and documenting findings clearly enough for the next person in the chain to act on. This is not a passive alert-monitoring role: it demands sound investigative judgement under time pressure, disciplined documentation, and good calibration on when to escalate versus resolve. This role operates within a 24x7 service delivery model, where high severity incidents require rapid response at any time and analysts are expected to manage a dynamic queue of concurrent alerts across multiple client environments while meeting defined response time objectives.

Schedule

Monday - Friday, 3:30pm - 12:00 ET

Responsibilities

• Review, analyze and investigate security alerts and incidents in Microsoft Defender and Sentinel environments.
• Identify and assess indicators of compromise (IOC) and attack (IOA) across client environments.
• Drive incidents through full lifecycle: triage -> investigation -> disposition -> escalation or closure.
• Accurately triage and classify alerts, minimizing false positives while preserving visibility into real threats and document outcomes to support continuous improvement and quality review.
• Execute incident response procedures aligned to defined playbooks and client escalation plans.
• Escalate incidents that meet client escalation criteria with documented evidence, impacted entities, and investigation summary.
• Support containment actions (e.g., isolate endpoints, kill processes) when access allows.
• Partner with client SOC or IT teams