Incident Response Analyst II / Information Technologist II

MSU Internal Job Postings Details•East Lansing, MI

10d•Hybrid

About The Position

The Incident Response Analyst II is a member of Michigan State University’s information security team, leading incident handling, vulnerability management, and threat analysis and research. The role frequently interfaces with customers and stakeholders across the university and provides opportunities to develop a specialization in incident response, such as development and tooling, network forensics, or malware analysis. Participation in the on-call rotation is required. The position is hybrid, with at least two days of work on campus, and is described as remote-friendly, with some or all duties performed remotely by mutual agreement. The analyst handles incident intake and serves as the primary responder for severity 1 and 2 security events, supports team investigations, and serves as backup tactical lead for senior analysis. The role also researches and assesses threats to university technology and internal actors; collaborates on impacts, indicators of compromise, detection methods, and response options; and works with security operations staff to implement detection and prevention measures. The position provides digital forensics and eDiscovery support, including fulfilling data collection and preservation orders such as search warrants, subpoenas, litigation holds, and FOIA requests. The analyst independently investigates, analyzes, and responds to cyber incidents within network environments or enclaves, coordinates with relevant departments and entities, and executes legal hold enforcement and maintenance as directed by the University Council. Michigan State University Information Technology provides leadership for strategic, financial, and policy initiatives affecting university IT and supports MSU’s education, research, and engagement missions. MSU has more than 12,000 faculty, academic, and support staff and over 51,000 students.

Requirements

Knowledge equivalent to that normally acquired by completing a four-year college degree program, or an equivalent combination of education and experience.
Three to five years of related and progressively more responsible or expansive work experience in information technology, risk and/or compliance, security administration and operations, or incident response.

Nice To Haves

Incident response experience.
Experience with security technologies such as intrusion detection and prevention systems, firewalls, log analysis/SIEM, antivirus, or endpoint protection.
Experience in digital forensics and eDiscovery.
Relevant certifications, such as GYPC, GCFE, GCFA, or CISSP; desired but not required.
Strong experience in one or more scripting languages, such as Bash, Python, or PowerShell; desired but not required.

Responsibilities

Handle intake of reported incidents and serve as the primary responder for severity 1 and 2 security events.
Provide analysis and specialized support during team-based investigation and response efforts.
Serve as the backup tactical lead for senior analysis.
Document cases according to team standards.
Research and analyze current and emerging threats to university technology and internal actors.
Collaborate with the team to determine potential impacts, indicators of compromise, detection methods, and response options.
Work with security operations staff to implement detection and prevention measures.
Provide digital forensics support and fulfill data collection and preservation orders, including search warrants, subpoenas, litigation holds, and FOIA requests.
Independently investigate, analyze, and respond to cyber incidents within network environments or enclaves.
Coordinate with other departments and entities to support awareness and open communication.
Execute legal hold enforcement and maintenance as directed by the University Council.
Participate in the on-call rotation.