Security Analyst

Safe-Guard Products International LLC•Atlanta, GA

13d•Hybrid

About The Position

Safeguard is seeking an Information Security Analyst to support the day-to-day operation and improvement of our security program. This is a hands-on, operationally focused role: you will triage and resolve security requests, serve as a first responder for potential security incidents, administer our physical access control and surveillance systems, and operate the platforms that protect our endpoints, network traffic, data, and infrastructure. The role sits at the intersection of several teams. You will partner regularly with infrastructure, application, and end-user support groups to make sure security requirements are understood, implemented, and sustained — not just documented. Success in this position looks like fewer recurring issues, cleaner detection signal, faster response, and stronger working relationships with the teams whose systems you help secure. Safeguard is an AI-first organization. We expect our security team to use AI assistants as part of their normal working rhythm: summarizing and correlating log data, drafting and refining detection logic, accelerating investigation write-ups, researching threats and techniques, and automating repetitive queue work. You do not need to be an AI specialist, but you should be genuinely comfortable working alongside these tools and interested in getting better at it.

Requirements

[2–4] years of hands-on experience in information security, IT operations with security responsibilities, or a security operations center.
Working knowledge of core security concepts: common attack techniques, defense-in-depth, least privilege, and the incident response lifecycle.
Practical experience with at least two of the following categories: endpoint detection and response, secure web/network access enforcement, vulnerability management, data access monitoring, or SIEM/log analysis.
Solid foundation in networking (TCP/IP, DNS, HTTP/S, VPN, firewalls, proxies) and in Windows and Linux administration.
Experience with identity and access management concepts, including directory services, authentication, MFA, and access review processes.
Ability to write clearly and concisely — incident notes, procedures, and findings that others can follow.
Strong organizational skills and the ability to manage a queue of competing priorities without losing track of work.
Working knowledge of AI assistants in a professional setting with the judgment to know when to rely on their output and when to verify it independently.
Comfortable working directly with technical peers outside of security to reach a workable outcome.
Bachelor's degree in information security, computer science, information systems, or equivalent practical experience.
Experience administering physical access control and video surveillance platforms.
Experience writing or tuning detection rules and reducing alert noise in a SIEM.
Scripting or automation experience (PowerShell, Python) for reporting, enrichment, or repetitive task reduction.
Exposure to cloud environments (Azure, AWS) and cloud security controls.
Familiarity with security and compliance frameworks such as NIST CSF, CIS Controls, SOC 2, PCI DSS.
Relevant certifications: Security+, CySA+, GCIH, GSEC, SSCP, or vendor-specific platform certifications.

Responsibilities

Own an assigned queue of security requests, access reviews, escalations, and remediation tasks, driving each to documented completion within defined service levels.
Maintain clear, auditable records of actions taken, decisions made, and evidence collected.
Identify recurring ticket drivers and recommend automation, configuration changes, or process improvements to reduce them.
Serve as first-level responder for security alerts and reported events: validate, triage, contain where appropriate, and escalate to senior staff with a clear written handoff.
Perform initial investigation using endpoint, network, identity, and log telemetry to determine scope and impact.
Contribute to post-incident documentation, root cause analysis, and follow-up remediation tracking.
Participate in an on-call or after-hours escalation rotation as required.
Operate and maintain the organization's core security tooling, including: Endpoint detection and response (EDR/XDR) — policy configuration, agent health and coverage, detection triage. Cloud-delivered secure web and network access (SSE/SWG/ZTNA) — policy management, traffic inspection rules, and access enforcement. Data security and access governance — monitoring sensitive data access, flagging anomalous activity, supporting permissions remediation and stale-data cleanup. Vulnerability management — scan configuration and scheduling, result validation, risk-based prioritization, and remediation tracking with system owners.
Monitor platform health, licensing, agent/sensor coverage gaps, and upgrade cycles.
Tune and maintain detection content in the organization's SIEM platform: refine correlation and detection rules, reduce false positives, and improve alert fidelity and context.
Onboard and validate new log sources; verify parsing, field normalization, and retention meet operational and compliance needs.
Build and maintain dashboards, saved searches, and reporting that give the team and leadership usable visibility.
Document detection logic, tuning rationale, and response guidance so alerts arrive with actionable next steps.
Administer and provide oversight for physical security systems, including badge and credential issuance, access group and door schedule configuration, card reader management, and video surveillance.
Conduct periodic access reviews for sensitive areas and coordinate timely revocation for departures and role changes.
Coordinate with facilities, HR, and vendors on installation, maintenance, troubleshooting, and system expansion.
Retrieve and preserve access logs and video footage in support of investigations, following documented chain-of-custody practices.
Use AI assistants in daily security work — triage summarization, log and telemetry analysis, detection logic drafting, documentation, scripting, and research — while applying independent judgment to validate output before acting on it.
Identify opportunities to reduce manual effort in the security queue through AI-assisted workflows and automation, and help build them out.
Handle data responsibly in AI workflows: understand what may and may not be shared with which systems, and follow Safeguard's internal AI usage and data handling standards.
Contribute to securing the organization's own AI adoption — reviewing AI tools and integrations for security and data exposure risk, and helping shape practical guardrails for other teams.
Work with infrastructure, network, application, and support teams to verify that security standards, hardening baselines, and configuration requirements are applied and maintained.
Review proposed changes and new deployments for security impact, and provide practical guidance rather than blanket objections.
Support internal and external audit, assessment, and compliance activities by gathering evidence and documenting controls.
Contribute to security awareness efforts and help translate security requirements into terms other teams can act on.