Security & Network Analyst II

About this role

Security & Network Analyst II

Under intermediate supervision, the Security & Network Analyst II supports cybersecurity operations by monitoring security events, identifying potential threats, and assisting with incident response activities. This role supports threat detection and incident response efforts, collaborates with security engineers and analysts to improve security controls, and contributes to threat hunting and detection tuning initiatives. The Security Analyst II applies developing expertise to identify risks, strengthen defenses, and enhance the organization's overall security posture.
Key Responsibilities & Essential Functions

• Support security and network operations activities with a focus on threat detection, cyber defense, incident response, and maintaining the security and availability of enterprise systems.

• Monitor, investigate, and resolve alerts from SIEM, EDR/XDR, IDS/IPS, firewall, vulnerability management, identity, cloud security, and network monitoring platforms.

• Analyze logs, endpoint telemetry, authentication records, firewall events, DNS activity, proxy logs, packet captures, and network flow data to identify security threats, operational issues, and performance concerns.

• Investigate and manage assigned tickets, including suspicious activity reports, security alerts, vulnerability findings, VPN issues, access requests, connectivity problems, and service interruptions.

• Conduct incident response activities, including event analysis, scoping, evidence collection, documentation, containment support, escalation, and post-incident follow-up in accordance with established procedures.

• Troubleshoot issues involving DNS, DHCP, routing, switching, firewall policies, VPN connectivity, wireless networks, identity services, endpoints, and application access.

• Evaluate false positives, benign activity, policy violations, operational issues, and security incidents requiring escalation or response.

• Escalate complex technical issues to Security Engineering, Network Engineering, Infrastructure, or application support teams with appropriate documentation, supporting evidence, and impact assessments.

• Assist with identifying recurring issues, monitoring gaps, alert quality concerns, and process improvement opportunities; recommend enhancements to strengthen operational effectiveness and security visibility.

• Support vulnerability management activities by validating findings, assessing exposure, assisting with remediation prioritization, and tracking resolution efforts.

• Assist with firewall rule reviews, VPN troubleshooting, network segmentation validation, access control issues, implementation testing, and post-change monitoring with minimal oversight.

• Collaborate with Security Engineering, Network Engineering, Infrastructure, and application teams to improve security monitoring, detection capabilities, operational procedures, and incident response processes.

• Create and maintain investigation notes, knowledge base articles, troubleshooting guides, operational procedures, and incident documentation with minimal oversight.

• Provide guidance and knowledge sharing to less experienced analysts and contribute to team training initiatives when needed.

• Participate in security projects, technology implementations, and continuous improvement efforts to enhance cybersecurity and network operations capabilities.

• Perform other duties as assigned.

Knowledge, Skills, and Abilities

• Bachelor's degree required; Master's degree preferred. A combination of education and experience will be considered in lieu of a degree.

• Three or more years of experience in technology, cybersecurity operations, network operations, infrastructure support, incident response, or a closely related technical role.

• Intermediate knowledge related to SOC, NOC, security operations, network operations, managed security, enterprise infrastructure, or hybrid security/network operations environment preferred.

• Demonstrated ability to work independently on complex tickets, alerts, incidents, and troubleshooting tasks with limited supervision and strong judgment on when to escalate.

• Intermediate Knowledge of TCP/IP, DNS, DHCP, routing, switching, VPNs, firewalls, proxy services, wireless networking, endpoint security, identity and access management, and common enterprise security controls.

• Intermediate experience using several of the following tools preferred: SIEM (e.g., Splunk), EDR/XDR (e.g., Microsoft Defender, Cortex XDR), firewall management platforms (e.g., Palo Alto Panorama/PA firewalls, Cisco firewalls), vulnerability scanners (e.g., Tenable), email/phishing security tools (e.g., PhishER), IDS/IPS, packet capture tools, network monitoring systems, log analysis platforms, ITSM/ticketing systems, and cloud security or infrastructure monitoring tools.

• Experience to analyze endpoint, identity, network, cloud, and application telemetry to identify anomalous activity, unauthorized access, malware behavior, phishing, credential abuse, lateral movement, vulnerability exploitation, or service degradation.

• Ability to perform structured troubleshooting and root-cause analysis across security, network, endpoint, identity, and application layers.

• Experience supporting incident response activities such as alert validation, event correlation, impact assessment, containment coordination, evidence collection, timeline development, and post-incident documentation.

• Experience reviewing or supporting firewall policies, VPN access, network segmentation, remote access technologies, and secure connectivity workflows preferred.

• Understanding of frameworks and models such as NIST NICE, NIST Cybersecurity Framework, NIST SP 800-53, CIS Controls, MITRE ATT&CK, or similar operational security frameworks preferred.

• Experience supporting hybrid cloud or SaaS environments such as AWS, Azure, Google Cloud, Microsoft 365, Okta, Entra ID, or similar platforms preferred.

•…