Cyber Security Analyst

Rozmith is hiring a Cyber Security Analyst to identify, investigate, and resolve threats across client environments before they become incidents. The role monitors security tools, investigates alerts, performs first-line containment, tracks vulnerabilities, tunes detections, gathers audit evidence, and communicates incident findings to clients.

Responsibilities:

• Monitor and triage alerts from Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, SentinelOne, Abnormal Security and Mimecast
• Correlate sign-in, endpoint, mailbox and network events in KQL to build a timeline of what happened
• Investigate phishing, account compromise, suspicious sign-ins and malware end to end
• Run first-line containment from runbooks: disable accounts, revoke sessions, isolate devices, purge messages
• Hand confirmed incidents to engineers with evidence, scope and recommended next steps
• Review Tenable vulnerability results and Axonius asset gaps, and track fixes to closure
• Tune detection rules to cut noise and catch real threats sooner
• Gather audit evidence in DigitalXForce for frameworks such as SOC 2
• Write incident reports in plain language for clients

Requirements:

• 1–3 years in a SOC, security operations or IT operations role
• Hands-on use of a SIEM and an enterprise EDR (Sentinel, CrowdStrike, SentinelOne or Defender for Endpoint)
• Basic KQL to search logs and build timelines
• Solid networking fundamentals: TCP/IP, DNS, HTTP, VPNs and firewalls
• Working knowledge of Windows, Active Directory, Entra ID and Microsoft 365 security
• Understanding of common attack techniques and MITRE ATT&CK
• A methodical approach: you document what you find and follow it through
• Clear written English
• MSP or multi-tenant SOC experience
• Regulated environments and frameworks such as SOC 2, GDPR, NIS2 or DORA
• FortiGate and FortiAnalyzer log analysis , Palo Alto, or Cisco experience
• Certifications: Security+, CySA+, SC-200, CrowdStrike CCFR