IT - ADMIN - Security Analyst - Project Lead

Location: Remote; open to nationwide candidates who can work Eastern Time hours. Preference given to candidates in Columbia, SC, or surrounding areas who can work onsite as needed. Candidates are responsible for all travel costs associated with onsite work.
Educational Qualification: Associate’s degree in Information Technology, Information Security, or a related field. Four years of relevant work experience may substitute for the degree.
Position Type: Contract – 12 months, with potential for extension.

Must Have Skills:

• 2 years of experience in security monitoring and incident response.
• 2 years of experience using the MITRE ATT&CK framework.
• 2 years of experience creating dashboards and reports.
• 2 years of experience supporting large Security Operations Center (SOC) operations.

• Experience with Palo Alto Cortex XSIAM/XDR.
• Knowledge of Linux, network administration, and network design.
• Experience administering firewalls, VPNs, Active Directory, and intrusion detection/prevention systems.
• Ability to work onsite as needed, with preference given to local South Carolina candidates and those available for onsite work over hybrid or fully remote arrangements.

• Monitor and correlate security events across SIEM, EDR, IDS/IPS, and threat intelligence sources to identify attack patterns, emerging threats, and incidents.
• Investigate suspicious activity, validate incidents, assess root causes and impact, and escalate critical incidents to Tier 3 with detailed findings.
• Prepare incident reports, timelines, post-incident summaries, and lessons learned, including recommendations for remediation and prevention.
• Investigate reported phishing attempts, malware infections, and potential policy violations; guide users and internal and external teams through containment and recovery.
• Improve SOC playbooks and workflows based on investigation findings.
• Tune detection rules, alert thresholds, and correlation logic to reduce false positives and strengthen threat coverage.
• Collaborate with engineering teams to configure and optimize monitoring tools and integrate new threat intelligence feeds.
• Proactively hunt for threats using current tactics, techniques, and procedures.
• Serve as a customer-facing subject matter expert, demonstrate the value of client services, and resolve issues.
• Document SOC processes, runbooks, and troubleshooting procedures.
• Coordinate with engineering, SOC, and agency staff to meet project goals.
• Perform additional duties as assigned.