Cybersecurity Incident Response Analyst II

Avnet•Chandler, AZ

About The Position

We are seeking a hands-on Cyber Incident Response Analyst to join a steadily maturing incident response program. In this role, you will be part of a global team operating in a follow‑the‑sun model across regions, supporting incident response through coordinated handoffs. The team operates on the CrowdStrike platform across EDR, NG‑SIEM, SOAR, case management, and Charlotte AI, working closely with an externally managed SOC to support escalated investigations. As we continue integrating AI capabilities into the platform, lower‑level triage work is handled automatically, allowing analysts to focus on deeper investigation, threat hunting, reporting, and improving how incidents are detected and handled.

Requirements

Demonstrates the ability to perform full investigations, including scoping, timeline reconstruction, root cause identification, and impact assessment.
Experience operating within EDR and SIEM platforms and using multiple telemetry sources to conduct investigations.
Hands-on experience with the CrowdStrike Falcon platform (EDR, NG-SIEM, Fusion, or related modules) and familiarity with Falcon Query Language or LogScale is strongly preferred.
Experience performing proactive threat hunting and identifying activity outside of alert-driven workflows.
Ability to correlate activity across endpoint, identity, network, and cloud systems without relying on a single tool.
Familiarity with MITRE ATT&CK and structured incident response practices aligned to frameworks such as NIST 800-61 Rev. 3.
Experience improving detections, playbooks, or response workflows based on investigation findings and recurring patterns.
Demonstrates the ability to take ownership during incidents and contribute to coordination or leadership of response activities.
Strong written and verbal communication skills, including the ability to clearly explain what is happening, what it means, and what needs to happen next during active incidents.
Ability to work effectively with SOC, engineering, infrastructure, and security teams to investigate and remediate threats.
Typically 1 to 3 years with bachelor's or equivalent.
Bachelor's degree or equivalent experience from which comparable knowledge and job skills can be obtained.
Applicant must be a U.S. Person (for example, a U.S. citizen or lawful permanent resident / green card holder) eligible to access Controlled Unclassified Information (CUI)
This position requires the employee to be a U.S. Citizen or National, or a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20), or a protected individual as defined by 8 U.S.C. 1324b(a)(3).

Nice To Haves

Relevant certifications preferred but not required

Responsibilities

Investigates and responds to escalated cybersecurity incidents, including validation, scoping, containment, and recovery, while determining root cause, scope, and business impact.
Analyzes activity across endpoint, network, cloud, and identity systems and correlates data across EDR, SIEM, and other telemetry sources to understand attacker behavior.
Serves as an escalation point for SOC analysts by guiding investigations, improving triage quality, and helping ensure consistency in analysis.
Performs proactive threat hunting using structured queries, threat intelligence, and observed activity to identify suspicious behavior beyond alert-driven detection.
Identifies detection gaps and contributes to improving detections, use cases, workflows, and overall response quality.
Maintains incident response playbooks, procedures, and investigation documentation, and develops clear incident reports and executive summaries for both technical and non-technical audiences.
Takes ownership of investigative workstreams during complex incidents and, when needed, assumes the role of incident commander until relieved by senior staff.
Participates in post-incident reviews and contributes to applying lessons learned to improve future detection and response.
Other duties as assigned