Cybersecurity Analyst

Star Group•Woodbury, NY

4d•Hybrid

About The Position

The Cybersecurity Analyst is a mid-level, hands-on role on Star Group’s IT Security team, reporting to the Cybersecurity Engineer. The role supports day-to-day security operations across corporate and field environments, including monitoring, incident response, vulnerability management, and compliance evidence collection. The analyst responds to security alerts, tickets, and audit requests while working with the IT Security Team to maintain and mature the organization’s security posture. The role provides hands-on exposure to endpoint protection, network access control, secure email gateways, application allowlisting, privileged access management, SIEM/SOAR, and vulnerability management. It also offers opportunities to contribute to security policy development and technology implementation, and to work with cross-functional teams on security solutions. The position is primarily office/hybrid at Star Group’s Woodbury, New York corporate office, with standard business hours and periodic after-hours availability for incident response. Occasional travel, estimated at 5–10%, to branch and field locations is required.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, or an equivalent combination of education and/or work experience.
3–5 years of hands-on experience in security operations, IT infrastructure/security, or a related technical role.
Demonstrated experience with at least two of the following: EDR/antivirus platforms, SIEM/SOAR, network access control, privileged access management, vulnerability scanning tools, application allowlisting technology, or email security gateways.
Working knowledge of endpoint protection, network security, identity and access management, and vulnerability management.
Familiarity with Windows Server and Windows endpoint administration, and working knowledge of Active Directory / Entra ID.
Basic to intermediate scripting ability in PowerShell, Python, or similar for automation, reporting, or log analysis.
Understanding of networking fundamentals, including TCP/IP, VLANs, firewalls, and VPNs, sufficient to investigate, troubleshoot, and adjudicate security events.
CompTIA Security+ at minimum, or equivalent experience; candidates actively pursuing certification will be considered.
Valid driver’s license, reliable transportation, and ability to meet the company’s motor vehicle policy.
Strong analytical and problem-solving skills, including the ability to triage ambiguous alerts and prioritize under time pressure.
Clear written and verbal communication skills and ability to document findings for technical and non-technical audiences.
Personal accountability and discretion when handling sensitive security and compliance information.
Ability to work across a broad security program in a small, high-ownership team.
Collaborative approach and ability to work with IT Operations, Internal Audit, and business stakeholders across a distributed, multi-site organization.
Ability to meet the physical requirements of prolonged sitting and computer use, and occasional lifting or moving of IT equipment up to 25 lbs.
Availability for after-hours security incident escalations as needed.

Nice To Haves

Experience supporting or participating in a compliance program for a publicly traded company.
Familiarity with NIST CSF 2.0, NIST SP 800-53, CIS Controls, ISO 27000, or the Secure Controls Framework.
GIAC certification such as GSEC, GCIH, or GCIA; CompTIA CySA+; CompTIA SecurityX (formerly CASP+); EC-Council Certified Ethical Hacker (CEH); or ISC2 SSCP.
Prior experience in a regulated or publicly traded company environment with audit and reporting obligations.
Experience in a distributed, multi-site operating environment such as retail, field services, distribution, or utilities.
Exposure to M&A IT/security integration activities.
Experience with cloud security fundamentals in Microsoft 365, Azure, or AWS.
Experience with SPF/DKIM/DMARC email analysis.

Responsibilities

Monitor and triage security alerts from EDR, NAC, SIEM/SOAR, ZTA, email security, and DLP platforms; investigate and escalate incidents using documented playbooks.
Perform first-line analysis of phishing reports, malware alerts, and suspicious activity, and coordinate containment and remediation of confirmed incidents.
Support tabletop exercises and post-incident reviews, and contribute to after-action reports and lessons-learned documentation.
Maintain and tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve detection and response times.
Perform after-hours security event containment and remediation as needed.
Run and review recurring vulnerability scans across servers, endpoints, and network infrastructure; validate and prioritize findings by exploitability and business risk.
Track vulnerability remediation against SLA targets, including expedited handling of CISA Known Exploited Vulnerabilities.
Coordinate with IT teams on patch deployment cycles and verify patch-compliance reporting.
Maintain the vulnerability management dashboard and produce recurring metrics for leadership and audit purposes.
Assist with day-to-day administration of privileged access management tooling, including privileged-account onboarding and offboarding, session review, and access certification support.
Support NAC operations, including device onboarding, policy exceptions, and investigation of unauthorized devices across more than 100 sites.
Assist with endpoint application-control and allowlisting requests, exception handling, and false-positive tuning.
Support quarterly and annual user access reviews for in-scope systems.
Collect, organize, and validate audit evidence for audits, industry assessments, and cybersecurity disclosure requirements.
Track and report security-awareness training completion, phishing simulation results, and related compliance metrics.
Maintain current documentation for security tools, configurations, and standard operating procedures.
Improve playbooks, runbooks, and automation to reduce manual effort and improve consistency.
Assist with evaluation and testing of security tools and integrations under the direction of the Security Engineer and Director, IT Security.
Support maintenance and reporting for the internal security program dashboard, including data quality of tracked metrics.
Travel occasionally to branch and field locations for security assessments, equipment deployment, or incident support.