Cyber Security Analyst (On Site)

*Only applicants currently within commuting distance of East Setauket, NY (11733) will be considered*

Company Description:

Stafford Associates, located in Setauket, NY, owns and operates a state-of-the-art certified AICPA/SOC PCI Compliant Data Center that provides such offerings as Colocation, Cloud Computing, and Managed Services. Our goal is to provide our customers with the most reliable, scalable and secure hosting services available today. We maintain this high level of service with a redundant data center infrastructure which is supported by a team of highly qualified engineers ready to meet any challenge.

Job Description:

Stafford Associates is currently seeking to fill a full-time position for a confident, detail-oriented person with a professional attitude. The ideal applicant would be someone who is a self-starter, organized, and can handle multiple tasks and ongoing projects as needed. This is a full-time position on our internal IT Security team, to implement, support, and maintain the security infrastructure for our clients and our hosting environment.

The Cybersecurity Analyst will be responsible for maintaining and enhancing the organization’s security posture by analyzing potential threats, detecting vulnerabilities, and implementing corrective measures. This role involves working with security tools, collaborating with cross-functional teams, and providing support in incident response. The ideal candidate will have practical experience with diverse security tools and frameworks, a strong understanding of networking concepts, and a commitment to continuous improvement of security operations.

This is an in-person position at our Setauket, NY location.

Responsibilities:

• Security Monitoring and Analysis
• Monitor and analyze security events, alerts, and logs using SIEM (Security Information and Event Management) and other security tools.
• Identify patterns and indicators of compromise to promptly alert the appropriate teams.
• Conduct vulnerability assessments and ensure scans are performed regularly and results are addressed.
• Incident Response and Investigation
• Collaborate with senior analysts and Incident Response teams to contain and eradicate threats.
• Perform triage on security incidents, documenting root causes and recommended actions.
• Collect and preserve evidence for forensic investigations, ensuring adherence to legal and regulatory requirements.
• Threat Intelligence and Risk Assessment
• Keep up to date with the latest threat intelligence and security trends, applying insights to refine internal defenses.
• Perform risk assessments to identify new and existing threats, vulnerabilities, and potential business impacts.
• Recommend effective mitigation strategies and work with stakeholders to implement improvements.
• Security Tools and Technologies
• Utilize security technologies (e.g., firewalls, intrusion detection/prevention systems, EDR/endpoint protection tools) to secure the network, servers, and endpoints.
• Provide input on the selection and configuration of new security solutions in alignment with organizational needs.
• Maintain documentation and asset inventories related to security tools and infrastructure.
• Policy and Compliance
• Ensure adherence to relevant regulations, standards, and internal security policies (e.g., ISO 27001, NIST CSF, PCI-DSS, HIPAA).
• Assist in developing and reviewing security policies and procedures.
• Provide guidance to other teams on implementing compliance requirements.
• Continuous Improvement
• Participate in security awareness training initiatives and help drive a security-first culture across the organization.
• Recommend enhancements to existing security processes, including automation and integration with other IT systems.

Qualifications:

• Technical Proficiency:
• Solid understanding of networking protocols (TCP/IP, DNS, HTTP, etc.
• Experience with common security tools (SIEM, IDS/IPS, endpoint protection, vulnerability scanners, etc.)
• Familiarity with scripting or automation tools (e.g., Python, PowerShell, Bash) is a plus.
• Experience conducting vulnerability assessments using various tools and methods. Experience using black box vulnerability scanners, web application scanners, and manual penetration testing tools is preferred.
• Industry Knowledge: Working knowledge of security frameworks (e.g., NIST, ISO) and regulatory standards (e.g., GDPR, HIPAA, PCI-DSS).
• Practical experience auditing controls and maintaining compliance with industry standard compliance frameworks. Familiarity with PCI DSS is a plus. Experience with SOC 2 audit engagements is also a plus.
• Soft Skills:
• Strong analytical and problem-solving abilities.
• Excellent written and verbal communication skills for collaboration with both technical and non-technical stakeholders.
• Keen attention to detail and ability to prioritize tasks effectively.