Cybersecurity Operator

Abrigo•Raleigh, NC

13d•Hybrid

About The Position

The Cybersecurity Operator sits within the Security Operations Team and is responsible for real-time monitoring, triage, and escalation of security events across corporate and cloud environments. This role serves as a frontline defender, analyzing alerts from SIEM, EDR, and email security platforms, and escalating potential threats to Cybersecurity Analysts. This position also supports recurring security operations activities, including access reviews, phishing simulation reporting, security metrics collection, and audit support. All activities are performed in alignment with established procedures and NIST 800-61 incident response standards, ensuring consistent detection, escalation, and documentation of security events.

Requirements

0–2 years of relevant cybersecurity or IT experience
Foundational understanding of: Threat detection and incident response
Foundational understanding of: Access management and least privilege principles
Foundational understanding of: Endpoint security and data protection
Foundational understanding of: Network fundamentals (TCP/IP, DNS, HTTP/S)
Strong attention to detail and ability to follow SOPs
Strong written and verbal communication skills
Ability to collaborate effectively across teams

Nice To Haves

Exposure to SIEM platforms (e.g., Rapid7, Splunk)
Exposure to EDR solutions (e.g., CrowdStrike, Microsoft Defender)
Familiarity with Microsoft 365 security tooling
Experience or exposure to AWS or Azure environments
Entry-level security certifications (Security+, CySA+, ISC2 CC, or similar)

Responsibilities

Monitor security alerts across SIEM, EDR, and email security platforms
Perform first-tier triage, classifying alerts based on known behaviors, false positives, and SOPs
Document incidents, artifacts, and actions in accordance with NIST 800-61
Review email quarantine for potential threats and policy violations
Conduct periodic user access reviews to validate least-privilege alignment
Support access recertification campaigns and track completion
Assist in reviewing security tooling exceptions
Support audits, assessments, and compliance reviews through evidence collection and validation
Collect and validate security metrics for leadership dashboards
Support execution of phishing simulation campaigns
Compile and analyze phishing metrics (click rate, reporting rate, credential capture)
Assist in preparing reports and materials for leadership review
Assist investigations by gathering logs, artifacts, and supporting data
Conduct research on emerging threats and vulnerabilities as assigned
Support security awareness initiatives and onboarding logistics
Contribute to detection engineering improvements by identifying gaps in telemetry