Security Operations Analyst

Responsibilities

• Operate identity threat detection and response with CrowdStrike Falcon Identity Protection: monitor and triage identity-based detections, assess risk and severity, apply risk-based policy actions within defined guardrails, and escalate confirmed threats to the Detect & Respond team;
• Investigate access anomalies end to end using identity telemetry in CrowdStrike Falcon Next-Gen SIEM — authentication events, MFA activity, privileged-account usage, and provisioning changes;
• Support tuning of identity detections, dashboards, and alert quality with the Detect & Respond team;
• Participate in incident response for identity-related incidents including account compromise, credential abuse, and unauthorized access — executing containment actions such as session revocation, credential reset, and access suspension under team runbooks;
• Monitor privileged and service-account activity for anomalous behavior and policy violations.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field — or equivalent work experience;
• 1–3 years in security operations, identity operations, a security operations center (SOC), or IT operations with significant identity or security scope;
• Working knowledge of IAM fundamentals: authentication and MFA, SSO concepts, directory services, joiner/mover/leaver lifecycle, and least-privilege access;
• Hands-on exposure to Okta or a comparable identity provider: user and group administration, MFA management, and basic application assignment; Okta strongly preferred;
• Familiarity with SOC practices: alert triage, severity assessment, escalation paths, evidence handling, and incident documentation;
• Exposure to a SIEM or security analytics platform — querying logs, investigating events, and reading detections; CrowdStrike Falcon Next-Gen SIEM a plus; willingness to develop CQL proficiency required;
• Active Directory fundamentals (users, groups, OUs) and familiarity with Microsoft Entra ID and Microsoft 365 administration concepts;
• Experience with an ITSM platform (ServiceNow preferred) in a ticket-driven operations environment;
• Strong written documentation habits — investigations, evidence, and runbooks that others can follow and auditors can rely on;
• Comfort using LLM and generative AI tools in day-to-day technical and analytical work.

Preferred Qualifications

• Direct experience with identity threat detection and response tooling (CrowdStrike Falcon Identity Protection or similar ITDR platform);
• Exposure to Okta Identity Governance or another IGA/access-certification platform (SailPoint, Saviynt, Omada);
• Familiarity with identity-focused attack techniques — credential stuffing, MFA fatigue, token theft, Kerberos abuse, lateral movement — and the MITRE ATT&CK framework;
• Basic scripting in PowerShell or Python for reporting, reconciliation, and evidence gathering;
• Awareness of non-human identity concepts: service accounts, credential scoping, and access patterns for LLM and agentic AI integrations;
• Exposure to attack surface/asset management (CAASM) tooling;
• Relevant certification: CompTIA Security+, Okta Certified Professional, Microsoft SC-300, or GIAC entry-level certification.