Cyber Threat Analyst Tier 2

Everforth ECS is seeking a Cyber Threat Analyst (Tier 2) to work remotely.

ECS is seeking a Cyber Threat Analyst (Tier 2) to support a multi-tenant Managed Security Services Provider (MSSP) environment protecting commercial customers and internal systems. Please Note: This position is contingent upon contract award.

This position serves as a senior investigator within the Security Operations Center, leading complex investigations, supporting incident response activities, improving detection capabilities, and mentoring junior analysts. The ideal candidate possesses strong investigative and incident response experience, is capable of independently managing complex security events, and can operate effectively in a fast-paced MSSP environment supporting multiple customers simultaneously.

Responsibilities

• Lead investigations involving malware, ransomware, business email compromise (BEC), account compromise, insider threats, cloud attacks, and advanced persistent threats.
• Perform incident response activities including forensic triage, scope determination, evidence collection, containment recommendations, root cause analysis, and post-incident reporting.
• Serve as the primary escalation point for Tier 1 analysts during complex investigations and security events.
• Manage multiple concurrent customer investigations while meeting service-level objectives and communication requirements.
• Coordinate response efforts with customers, IT teams, system administrators, and executive stakeholders.
• Develop detailed technical incident reports, executive summaries, and customer-facing communications.
• Conduct forensic triage across endpoints, servers, cloud platforms, email environments, and identity providers.
• Analyze and correlate telemetry from SIEM, EDR, SOAR, NDR, cloud monitoring platforms, identity providers, email security tools, and threat intelligence sources.
• Recommend, validate, test, and optimize detection content aligned with MITRE ATT&CK techniques and observed adversary behavior.
• Conduct targeted threat hunts based on intelligence requirements, active investigations, or emerging threats, and contribute findings to detection improvement efforts.
• Investigate security events across on-premises, cloud, SaaS, endpoint, network, and identity environments.
• Analyze attacker behavior and map observed activity to MITRE ATT&CK techniques to support reporting, threat tracking, and investigation activities.
• Utilize commercial and open-source threat intelligence to enrich investigations and identify emerging threats.
• Collaborate with Detection Engineering and SOAR teams to improve alert fidelity, reduce false positives, and increase operational efficiency.