Cyber Security Analyst

Primoris Services Corporation•Texas, TX

6d•$110,000 - $120,000

About The Position

The Cybersecurity Analyst – SOC Operations is responsible for monitoring, detecting, investigating, and responding to cybersecurity threats across the enterprise environment. This role serves as a key member of the Security Operations Center (SOC) and focuses on threat detection, incident response, endpoint security, identity threats, and security monitoring of enterprise infrastructure, cloud environments, and critical business systems. The analyst will investigate security alerts, triage incidents, correlate threat intelligence, and collaborate with IT and infrastructure teams to contain and remediate cybersecurity risks. This position plays an operational role in maintaining enterprise security visibility and minimizing cyber risk exposure.

Requirements

5+ years of Cybersecurity experience required
CrowdStrike Falcon experience required
SIEM platforms such as Microsoft Sentinel, Splunk Enterprise Security, or similar
EDR/XDR solutions such as Microsoft Defender for Endpoint or comparable platforms
Security log analysis and event correlation
Identity monitoring in environments such as Microsoft Entra ID, Active Directory, Privileged Access Management systems
Authentication threat analysis
Firewall, DNS, proxy, and network telemetry analysis
Experience with Zscaler
Experience with Microsoft security ecosystem
Experience with Cloud security monitoring tools
Familiarity with SaaS and remote-access security models
Experience with scripting (PowerShell, Python, or Bash preferred)
Familiarity with SOAR and security automation

Nice To Haves

CompTIA Security+
CompTIA CySA+
GCIH
AZ-500
CISSP (preferred for senior analyst level)

Responsibilities

Monitor enterprise security tools and alerts for suspicious activity, malicious behavior, or policy violations.
Analyze and triage security events generated from SIEM platforms, Endpoint Detection & Response (EDR), Email security platforms, Network monitoring tools, Identity and access monitoring solutions, and Cloud security platforms.
Investigate indicators of compromise (IOCs), anomalous behaviors, and suspicious user activity.
Correlate logs and events across multiple security systems to identify threats.
Escalate high-risk incidents according to playbooks and incident severity classifications.
Participate in cybersecurity incident response activities including detection, triage, containment, eradication, recovery, and post-incident review.
Investigate phishing, malware, ransomware, account compromise, insider threat, and unauthorized access incidents.
Document incident findings, root cause analysis, and remediation recommendations.
Support after-hours cybersecurity response activities when necessary.
Monitor endpoint security posture and investigate endpoint-related threats.
Analyze authentication anomalies including privileged account misuse, impossible travel, MFA anomalies, suspicious logins, and excessive failed authentication attempts.
Support Zero Trust security initiatives through continuous monitoring of identity, device, and access risks.
Investigate unusual network behavior and lateral movement attempts.
Monitor cloud security events across Microsoft 365, Azure, SaaS platforms, and enterprise cloud services.
Investigate risky cloud behaviors, privilege escalation, abnormal sharing, and unauthorized access attempts.
Assist with remediation of cloud security findings and misconfigurations.
Review vulnerability scan results and assist with prioritization of remediation activities.
Validate remediation of critical vulnerabilities.
Monitor exposure trends and recurring weaknesses affecting enterprise systems.
Assist in developing playbooks and incident response procedures.
Support SOAR workflows and automation initiatives.
Identify opportunities to improve detection coverage and operational efficiencies.
Contribute to lessons learned and continuous improvement activities.