Security Analyst

Job Summary:

The Security Analyst - Project Lead will support statewide security incident response by analyzing security events, investigating incidents, and leading efforts to improve security operations. This role involves deep analysis of threats, coordination with teams, and serving as a subject matter expert to enhance organizational security posture. The position is remote with a preference for onsite availability in South Carolina and requires working Eastern Time Zone hours.

• Continuously review and correlate security event data across SIEM, EDR, IDS/IPS, and threat intelligence sources to identify complex attack patterns and security incidents.
• Perform deep-dive analysis of suspicious activity, validate incidents, determine root cause and impact, and escalate critical incidents with detailed context.
• Create detailed incident reports, timelines, and post-incident summaries; contribute to lessons-learned documentation and remediation recommendations.
• Investigate user-reported phishing, malware infections, and policy violations; advise users and teams on containment and recovery actions.
• Recommend updates to SOC playbooks, workflows, detection rules, alert thresholds, and correlation logic to reduce false positives and improve threat coverage.
• Collaborate with engineering teams to ensure proper configuration and tuning of monitoring tools and integrate new threat intelligence feeds.
• Proactively hunt for threats using current tactics, techniques, and procedures (TTPs).
• Serve as a customer-facing subject matter expert, demonstrating capabilities and resolving issues.
• Document processes, runbooks, and troubleshooting steps related to SOC operations.
• Coordinate with engineering, SOC, and agency staff to meet security goals.
• Perform other duties as needed.

• Minimum 2 years of experience in security monitoring and incident response.
• Minimum 2 years of experience with the MITRE ATT&CK framework.
• Minimum 2 years of experience with dashboard creation and reporting.
• Associate's degree in IT or information security field, or four years of relevant work experience substituting education.
• Two years of experience supporting large Security Operations Center (SOC) operations.

• Experience with Palo Alto Cortex XSIAM/XDR platform.
• Knowledge of Linux, network administration, and network design.
• Experience administering firewalls, VPN technology, Active Directory, and intrusion detection/prevention systems.
• Residency or proximity to Columbia, South Carolina or surrounding areas is preferred.

• Preference given to candidates able to work onsite over hybrid or full remote; onsite presence as needed is required.
• Must be able to work Eastern Time Zone hours.
• All travel-related costs for onsite work are the responsibility of the resource.
• Security clearance or background checks including drug, driving, credit, criminal, E-Verify, and SLED checks may be required.

• Full-time position, 40 hours per week.
• Remote work location with expectation of availability during Eastern Time Zone business hours.
• Contract duration of 12 months with possibility for extension.