Cybersecurity Analyst

Star Group, LP•Woodbury, NY

7d•$85,000 - $100,000•Hybrid

About The Position

The Cybersecurity Analyst is a mid-level, hands-on role within Star Group's IT Security team, reporting to the Cybersecurity Engineer. The role supports day-to-day security operations across corporate and field environments, including monitoring, incident response, vulnerability management, and compliance evidence collection. The analyst works with the IT Security Team to maintain and improve the organization's security posture and responds to security alerts, tickets, and audit requests. The position offers exposure to endpoint protection, network access control, secure email gateways, application allowlisting, privileged access management, SIEM/SOAR, and vulnerability management. It also provides opportunities to contribute to security policy development, technology implementation, and cross-functional security solutions. The role is primarily office/hybrid, based at Star Group's Woodbury, NY corporate office, with standard business hours and periodic after-hours incident-response availability. Occasional travel, estimated at 5–10%, to branch and field locations is required. The work involves prolonged sitting and computer use and occasional lifting or moving of IT equipment weighing up to 25 pounds.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or an equivalent combination of education and/or work experience.
3–5 years of hands-on experience in security operations, IT infrastructure/security, or a related technical role.
Demonstrated experience with at least two of the following: EDR/antivirus platforms, SIEM/SOAR, network access control, privileged access management, vulnerability scanning tools, application allowlisting technology, or email security gateways.
CompTIA Security+ at minimum, or equivalent experience; candidates actively pursuing certification will be considered.
Working knowledge of endpoint protection, network security, identity and access management, and vulnerability management.
Familiarity with Windows Server and Windows endpoint administration, and working knowledge of Active Directory / Entra ID.
Basic to intermediate scripting ability in PowerShell, Python, or similar for automation, reporting, or log analysis.
Understanding of TCP/IP, VLANs, firewalls, and VPNs sufficient to investigate, troubleshoot, and adjudicate security events.
Valid driver's license, reliable transportation, and ability to meet the company's motor vehicle policy.
Strong analytical and problem-solving skills, including the ability to triage ambiguous alerts and prioritize under time pressure.
Clear written and verbal communication skills and ability to document findings for technical and non-technical audiences.
Personal accountability and discretion in handling sensitive security and compliance information.
Ability to work across the breadth of a security program in a small, high-ownership team.
Collaborative approach when working with IT Operations, Internal Audit, and business stakeholders across a distributed, multi-site organization.
Availability for after-hours security incident escalations as needed.

Nice To Haves

Experience supporting or participating in a compliance program for a publicly traded company.
Familiarity with security frameworks such as NIST CSF 2.0, NIST SP 800-53, CIS Controls, ISO 27000, or the Secure Controls Framework.
GIAC certification such as GSEC, GCIH, or GCIA; CompTIA CySA+; CompTIA SecurityX (formerly CASP+); EC-Council Certified Ethical Hacker (CEH); or ISC2 SSCP. Candidates actively pursuing certification will be considered.
Prior experience in a regulated or publicly traded company environment with audit and reporting obligations.
Experience in a distributed, multi-site operating environment such as retail, field services, distribution, or utilities.
Exposure to M&A IT/security integration activities.
Experience with cloud security fundamentals in Microsoft 365, Azure, or AWS.
Experience with SPF/DKIM/DMARC email analysis.

Responsibilities

Monitor and triage security alerts and events from EDR, NAC, SIEM/SOAR, ZTA, email security, and DLP platforms; investigate and escalate according to incident-response playbooks.
Analyze phishing reports, malware alerts, and suspicious activity; coordinate containment and remediation of confirmed incidents with the IT Security Team.
Support tabletop exercises and post-incident reviews, and contribute to after-action reports and lessons-learned documentation.
Maintain and tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve detection and response times.
Perform after-hours security event containment and remediation as needed.
Run and review recurring vulnerability scans across servers, endpoints, and network infrastructure; validate and prioritize findings based on exploitability and business risk.
Track vulnerability remediation against SLA targets, including expedited handling of CISA Known Exploited Vulnerabilities.
Coordinate with IT teams on patch cycles for servers, workstations, endpoint devices, and SaaS solutions; verify patch-compliance reporting.
Maintain the vulnerability management dashboard and produce recurring metrics for leadership and audits.
Support day-to-day PAM operations, including privileged-account onboarding and offboarding, session review, and access certification.
Support NAC operations, including device onboarding, policy exceptions, and investigation of unauthorized devices across 100+ sites.
Administer endpoint application-control and allowlisting requests, exceptions, and false-positive tuning.
Support quarterly and annual user access reviews for in-scope systems.
Collect, organize, and validate audit evidence for audit requirements, industry assessments, and cybersecurity disclosure requirements.
Track and report security-awareness training completion, phishing-simulation results, and related compliance metrics.
Maintain current documentation for security tools, configurations, and standard operating procedures.
Improve playbooks, runbooks, and automation to reduce manual effort and improve consistency.
Assist with evaluating and testing security tools and integrations under the direction of the Security Engineer and Director, IT Security.
Support maintenance and reporting for the team's internal security program dashboard, including the quality of tracked metrics.