Security Analyst I

• Schedule & Environment: 24/7 SOC schedule (includes nights, weekends, holidays, and on-call for incidents)
• Certification Required: Active CompTIA Security+
• Key Tools: Splunk SIEM, Splunk SOAR, Proofpoint & Azure Security
• Eligibility: Must be authorized to work in the US. W2 employment only (no visa sponsorship available; no C2C/subcontracting)

Aquent is partnering with a leading organization at the forefront of delivering essential services, where safeguarding critical infrastructure and data is paramount. This organization is committed to operational excellence and relies on robust cybersecurity measures to ensure continuous, reliable service for its customers. We are seeking passionate and dedicated individuals to join their vital cybersecurity team, playing a crucial role in protecting their digital landscape and contributing directly to the security and resilience of their operations.

Are you ready to be the frontline defender in the ever-evolving world of cyber threats? Our client is seeking dynamic individuals to step into a critical role within their 24/7 Security Operations Center (SOC). As a key member of the team, you will be instrumental in the initial detection, analysis, and response to security incidents, making a tangible impact on the organization's security posture. This is an exciting opportunity for a curious, analytical, and highly motivated professional to contribute to a fast-paced environment, leveraging cutting-edge tools to protect vital assets and ensure operational continuity.

What You'll Do:

• Monitor and analyze security events and alerts generated from SIEM platforms (e.g., Splunk) and other security tools.
• Perform initial triage and investigation of alerts to determine their severity, scope, and potential impact on systems and data.
• Analyze logs, network activity, endpoint data, and email security alerts (e.g., Proofpoint) to identify malicious activity.
• Enrich security alerts with contextual data, including threat intelligence, asset information, and user behavior analytics, to facilitate informed decision-making.
• Follow defined escalation paths to more senior analysts (Tier 2/3) based on the severity, confidence, and impact of detected incidents.
• Document all incidents, findings, and actions taken thoroughly within case management systems.
• Execute basic response actions and automated playbooks using SOAR platforms (e.g., Splunk SOAR).
• Assist in containment actions for active threats under the guidance of senior team members.
• Contribute to 24/7 SOC operations, including participating in shift work, ensuring continuous monitoring and response capabilities.
• Actively participate in shift handoffs, providing comprehensive updates to maintain situational awareness across the team.
• Stay current on emerging threats, vulnerabilities, and attack techniques to enhance detection and response capabilities.
• Provide valuable feedback for the tuning of detection rules to improve alert fidelity and reduce false positives.

What You'll Bring:

• Minimum 2 years of experience in a 24/7 Security Operations Center (SOC) environment is highly preferred.
• Associate degree in Cybersecurity, Information Technology, or a related field, OR equivalent practical experience in a SOC setting.
• CompTIA Security+ Certification is required.
• Demonstrated experience with security tools such as Splunk, Splunk SOAR, and Proofpoint.
• Proven experience in triaging security alerts and following established escalation processes.
• Foundational knowledge of networking fundamentals and log analysis techniques.
• Familiarity with Microsoft and Azure security platforms and services.
• Strong analytical thinking and problem-solving skills to dissect complex security incidents.
• Exceptional attention to detail in monitoring, investigation, and documentation.
• Excellent communication skills, both written and verbal, for effective collaboration and incident reporting.
• Adaptability and resilience to thrive in a fast-paced, dynamic cybersecurity environment.
• A high degree of curiosity and initiative to continuously learn and improve.
• A collaborative spirit, working effectively within a team to achieve common security goals.

Bonus Points:

• CompTIA CySA+ certification.
• Splunk Core Certified User certification.
• Microsoft Security certifications (e.g., SC-200, AZ-500).

This role operates within a 24/7 Security Operations Center environment, which includes working nights, weekends, and holidays. You may also be required to be on-call or work extended hours during critical incidents to ensure continuous protection.