Cyber Defense Analyst

FlightSafety International•Columbus, OH

About The Position

FlightSafety International is the world’s premier professional aviation training company and a supplier of flight simulators, visual systems, and displays to commercial, government, and military organizations. It provides training for pilots, technicians, and other aviation professionals from 167 countries and independent territories, and operates a large fleet of advanced full-flight simulators and maintenance training at locations in the United States, Canada, France, and the United Kingdom. The Security Analyst is a junior information security professional responsible for security monitoring, event investigation, operational support, control validation, documentation, and risk-based escalation across the enterprise. The role is intended for individuals developing foundational cybersecurity expertise and practical security operations experience. Analysts build proficiency in an assigned specialization while gaining working capability across adjacent security disciplines through cross-training, projects, incident response, mentoring, and structured development opportunities. The Detection & Incident Response specialization focuses on monitoring, investigating, documenting, and supporting responses to enterprise security events. It is a primary focus rather than an exclusive boundary; analysts may support other Information Security functions as business and operational priorities require. The role performs routine investigations, operational activities, and assigned projects with limited supervision, applying documented procedures and exercising judgment within defined authority limits. Significant events, high-impact risks, policy exceptions, and unfamiliar situations are escalated to senior team members or leadership. The position may require eligibility to obtain and maintain a U.S. Government security clearance. It may involve access to export-controlled technology or services, and employment consideration is contingent on meeting applicable export authorization requirements. Offers are also contingent on required compliance reviews, including OFAC screening.

Requirements

Two to four years of experience in cybersecurity, IT operations, system administration, networking, cloud administration, identity management, technical support, engineering, risk management, audit, software delivery, military service, or related disciplines.
Foundational knowledge of cybersecurity threats, vulnerabilities, security controls, risk concepts, and incident-response practices.
Understanding of common attacker tactics, techniques, and procedures, phishing campaigns, malware, credential attacks, and other common threat activities.
Familiarity with security monitoring, endpoint security tools, SIEM platforms, case management, and investigation processes.
Ability to analyze logs, alerts, telemetry, and investigative artifacts from multiple security technologies.
Ability to correlate information from multiple sources to determine the scope, impact, and potential risk of security events.
Ability to assess event severity and determine when escalation or additional investigation is required.
Ability to collect, organize, document, and present investigative evidence using established procedures.
Ability to identify root causes, recognize control gaps, and support risk-informed recommendations.
Ability to develop proficiency within a specialization while working effectively across multiple security domains.
Ability to learn new technologies, security concepts, tools, and operational processes.
Ability to identify opportunities to improve reliability, usability, automation, and control effectiveness.
Ability to write clear documentation, procedures, case notes, findings, and stakeholder communications.
Ability to communicate technical findings, risks, and recommendations to technical and non-technical audiences.
Ability to manage multiple priorities in a fast-paced environment.
Ability to collaborate effectively across technical, business, vendor, remote, and virtual teams.
Demonstrated integrity, professionalism, sound judgment, and appropriate handling of sensitive information.
Demonstrated curiosity, analytical thinking, and a willingness to investigate, learn, and continuously improve security knowledge and technical skills.
Perform routine investigations, operational activities, and assigned projects with limited supervision, exercising judgment within defined authority limits.
Meet applicable export-control requirements for any role access to ITAR- or EAR-controlled technology or services.

Nice To Haves

Direct experience in Detection & Incident Response is preferred but not required.
Relevant formal education, such as a bachelor’s degree in Cybersecurity or Information Technology.
Industry-recognized cybersecurity certifications.
Military training or service.
Professional or technical experience and demonstrated practical cybersecurity skills.

Responsibilities

Monitor, triage, and investigate security alerts and events using endpoint, identity, network, cloud, SaaS, email, and SIEM telemetry.
Assess event severity, business impact, and response priority using established processes and risk-based judgment.
Coordinate investigative and response activities with MDR providers, technical teams, and business stakeholders.
Execute approved containment and response actions within documented authority limits and procedures.
Support incident containment, eradication, recovery, post-incident review, and corrective-action activities.
Apply threat intelligence, indicators of compromise, and contextual information during investigations.
Collect, preserve, organize, and document investigative evidence.
Maintain accurate incident records, timelines, findings, escalation decisions, and handoffs.
Manage assigned investigations, cases, and response activities through completion, including status updates, documentation, and follow-up actions.
Support detection tuning, alert validation, automation initiatives, and investigation workflow improvements.
Participate in threat hunting, detection validation, and threat-informed analysis as assigned.
Contribute to root-cause analysis and continuous improvement following security incidents.
Perform security analysis and operational activities within established procedures, controls, and authority limits.
Apply foundational security principles across identity, endpoint, application, cloud, data, infrastructure, governance, and incident-management activities.
Maintain complete and accurate documentation of analysis, decisions, evidence, approvals, exceptions, and escalations.
Escalate ambiguous, high-risk, or high-impact situations appropriately.
Participate in audits, assessments, control validation, tabletop exercises, major incidents, and enterprise initiatives.
Collaborate with Information Security, IT, Engineering, Product, and business teams.
Identify recurring issues, control gaps, and opportunities to improve security effectiveness, operational efficiency, and automation.
Use approved automation, AI-assisted tools, and operational workflows appropriately to improve efficiency, consistency, and security outcomes.
Develop and communicate meaningful security, operational, and risk-related metrics.
Maintain procedures and runbooks and contribute to secondary coverage for critical security services.
Support organizational priorities through incident response, project participation, cross-functional assignments, and rotational opportunities.
Develop security skills that transfer across technologies, vendors, and platforms.
Protect sensitive information, communicate effectively, manage competing priorities, and remain accountable for work quality.
Apply documented response processes to identify, analyze, and escalate security events; seek guidance when situations exceed procedures or experience.
Provide recommendations based on available evidence and analysis.