Cyber Security Analyst II

Hansell Tierney is recruiting for a Cybersecurity Analyst II to support a client’s day-to-day security operations. The role focuses on alert investigation, incident response, security tool tuning, reporting, documentation, and implementation of practical security controls across infrastructure, endpoint, cloud, network, and business teams.

Responsibilities:

• Proactively monitor the environment to detect, analyze, and help mitigate cyber threats as part of daily security operations
• Review, investigate, and respond to real-time alerts across SIEM, EDR/XDR, email security, identity, network, cloud, and other security platforms
• Support incident response by gathering evidence, documenting timelines, coordinating containment and mitigation activity, and communicating status clearly to stakeholders
• Configure, maintain, monitor, and tune security tools to improve detection fidelity and reduce recurring false positives
• Translate security strategy into tactical work items, runbooks, use cases, reporting, and control improvements
• Collaborate across infrastructure, endpoint, cloud, network, application, and business teams to implement practical, risk-based security controls
• Create reporting and metrics that demonstrate security program health, operational trends, investigation outcomes, and opportunities for improvement
• Develop or implement scripts, queries, dashboards, or tools that improve detection, prevention, analysis, reporting, or workflow efficiency
• Lead small security workstreams or discrete implementation efforts as needed, escalating architectural or policy decisions appropriately

Requirements:

• • 4–6 years of progressive IT and security experience, including hands-on security operations, cyber defense, and incident response
• • Strong hands-on EDR/XDR investigation experience, including endpoint timeline review, suspicious process analysis, containment coordination, and remediation validation
• • Strong hands-on SIEM experience, including log analysis, query writing, alert triage, correlation, use-case tuning, and detection quality improvement
• • Experience administering or technically supporting at least one major security platform (e.g., EDR/XDR, SIEM, secure email gateway, phishing simulation, vulnerability management, identity security, or cloud security monitoring)
• • Experience with phishing analysis and email security workflows, including header review, URL/domain/file reputation analysis, user reporting, and response documentation
• • Working knowledge of Active Directory and Azure AD/Entra ID security concepts, including MFA, conditional access, authentication anomalies, and identity-based investigations
• • Practical understanding of incident response phases, evidence handling, containment/eradication/recovery coordination, and post-incident documentation
• • Ability to investigate network anomalies and security events across on-premises and cloud environments
• • Ability to communicate technical findings clearly to non-technical audiences with written summaries, recommendations, and decision-ready context
• • Working knowledge of security frameworks and concepts such as NIST, MITRE ATT&CK, least privilege, defense-in-depth, vulnerability management, and ITSM practices
• • Ability to operate independently under time pressure, manage multiple priorities, and escalate appropriately as risk or business impact evolves
• US citizens and those authorized to work in the US are encouraged to apply.
• Work sponsorship is not currently available.
• • Bachelor's degree in information security, computer science, or equivalent experience preferred
• • PowerShell, Python, SPL, or other scripting/query language experience for automation, detection, and analysis
• • Experience creating dashboards or metrics in Power BI or similar reporting and visualization tools
• • Familiarity with Microsoft security tooling, Azure security monitoring, AWS or GCP security monitoring, or hybrid cloud security concepts
• • Experience building runbooks, detection logic, incident report templates, executive-ready summaries, or security operations process improvements
• • Experience with AI model integration for cybersecurity monitoring
• • Relevant certifications such as Security+, CySA+, GCIH, GCIA, GCFA, or equivalent practical experience