The Role:

• Monitors internal hosted and partner hosted detections systems for indications of compromise, data loss, or other abnormalities.
• Responds to alerts detected in the environment by investigating them with internal team members, 3rd party partners, and users.
• Follows up on the detection of activity to malicious links, email attachments, web activity, and other detections of abnormal activity in the environment.
• Uses tools to actively hunt down treats in the environment. 
• Coordinate efforts with other team members and partners to handle security issues identified in the environment.
• Takes action to address issues detected in the environment through actions such as removing malicious email messages, rotating/disabling passwords, network containing computers, or cleaning up infected computers.
• Monitors access logs for unusual activity, suspicious accounts, or access assignments. This may include unusual travel, excessive lockouts, access from unexpected devices, and access to information not expected for a job role.
• Executes action and coordinate efforts with IT team members to handle authentication or user access issues identified in the environment. 
• Monitors the regular execution of network scanning and reporting tools and 3rd party efforts.
• Contributes to efforts to identify high priority vulnerabilities and end of life assets in the IT landscape.
• Works with IT infrastructure and application team members to implement and monitor vulnerability remediation efforts.
• Manage ongoing security education efforts.
• Assists with the intake and initial response for IT security questionnaires for customers and other partner organizations.
• Participates in backup, disaster recover, and incident management tests/exercises.
• Assist with compliance efforts (SOX, PCIDSS, GDRP) and internal audits.