Security Analyst

Job Title : Security Analyst – Incident Response & SOC Operations

Position Overview

Support statewide security incident response through hands-on security monitoring, threat investigation, incident analysis, and Security Operations Center (SOC) improvement. This role offers the opportunity to investigate complex security events, strengthen detection and response workflows, collaborate with engineering teams, and serve as a subject matter expert supporting security operations.

What You'll Do / Key Responsibilities

• Continuously review and correlate security event data across SIEM, EDR, IDS/IPS, and threat intelligence sources to identify complex attack patterns, emerging threats, and security incidents.

• Perform in-depth analysis of suspicious activity, validate incidents, determine root cause and impact, and escalate critical incidents to Tier 3 with detailed context as required.

• Create incident reports, timelines, and post-incident summaries; contribute to lessons-learned documentation and remediation and prevention recommendations.

• Investigate user-reported phishing, malware infections, and potential policy violations, advising users and internal and external teams on containment and recovery actions.

• Recommend improvements to SOC playbooks and workflows based on investigation findings; fine-tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve threat coverage.

• Collaborate with engineering teams to configure and tune monitoring tools, integrate threat intelligence feeds, and proactively hunt for threats using current tactics, techniques, and procedures (TTPs).

• Serve as a customer-facing subject matter expert, demonstrate security service capabilities, communicate their value, and help resolve issues.

• Document SOC processes, runbooks, and troubleshooting steps.

• Coordinate with engineering teams, SOC personnel, and agency staff to meet operational goals.

• Perform other duties as needed.

Required Qualifications

• Associate’s degree in an information technology or information security-related field, or 4+ years of relevant work experience may be substituted in lieu of education.

• 2+ years of experience with security monitoring and incident response.

• 2+ years of experience with the MITRE ATT&CK framework.

• 2+ years of experience with dashboard creation and reporting.

• 2+ years of experience supporting large SOC operations.

• Ability to work Eastern Time Zone hours.

Preferred Qualifications

• Experience with the Palo Alto Cortex XSIAM/XDR platform.

• Knowledge of Linux, network administration, and network design.

• Experience administering firewalls, VPN technology, Active Directory, and Intrusion Detection/Prevention systems.

• CISSP, CISA, CISO, or equivalent advanced security certification.

• Additional relevant certifications, such as CEH, OSCP, or GPEN.

• Vendor certifications related to information security.

• Located in Columbia, SC, or a surrounding South Carolina city, with availability to work onsite as needed.

#SecurityAnalyst #SOCAnalyst #SecurityOperations #IncidentResponse #CyberSecurity #MITREATTACK #SecurityMonitoring #SOCOperations #ThreatHunting #SIEM #EDR #PaloAltoCortex #XSIAM