IT Security Analyst

Cook County State's Attorney Office•Chicago, IL

4d•Onsite

About The Position

We are seeking a motivated and detail-oriented IT Security Analyst to join our Information Technology team. This role is responsible for monitoring, analyzing, and responding to cybersecurity threats while helping maintain the security, integrity, and availability of the organization�s systems and data. The IT Security Analyst will work closely with infrastructure, desktop support, cloud, and application teams to implement and maintain security best practices across the enterprise environment. The ideal candidate will have experience with Microsoft 365 security technologies, Active Directory, endpoint protection, vulnerability management, SIEM monitoring, and incident response in an enterprise environment.

Requirements

Experience supporting enterprise IT security operations in a Windows-based environment.
Strong knowledge of Microsoft 365 Security & Compliance, Microsoft Defender Suite, Exchange Online, Active Directory / Group Policy, Microsoft Entra ID (Azure AD), Windows Server and Windows 10/11, endpoint protection and EDR solutions, and SIEM and log analysis tools.
Experience with vulnerability scanning and remediation tools.
Understanding of networking fundamentals including TCP/IP, DNS, DHCP, VPN, and firewalls.
Experience with PowerShell scripting for automation and administration.
Familiarity with security frameworks and best practices such as NIST, CIS Controls, Zero Trust, and Least Privilege.
Knowledge of cloud security concepts within Azure and Microsoft 365 environments.
Strong troubleshooting, analytical, and problem-solving skills.
Ability to handle sensitive and confidential information appropriately.
Excellent written and verbal communication skills.

Nice To Haves

Bachelor�s degree in Information Technology, Cybersecurity, Computer Science, or related field preferred.
Microsoft certifications required or equivalent work experience, including Microsoft Certified: Security Operations Analyst Associate, Microsoft Certified: Cybersecurity Architect Expert, and Microsoft Certified: Azure Security Engineer Associate.
Additional certifications are a plus: Security+, CISSP, CEH, SC-200 / SC-300 / AZ-500.
Experience working in enterprise, government, legal, healthcare, or highly regulated environments preferred.

Responsibilities

Monitor and respond to cybersecurity alerts, incidents, and suspicious activities across servers, endpoints, cloud platforms, and network infrastructure.
Investigate security events and perform incident response activities, including containment, remediation, recovery, and documentation.
Manage and monitor Microsoft 365 security tools including Microsoft Defender, Exchange Online Protection, Microsoft Entra ID (Azure AD), Conditional Access, Data Loss Prevention (DLP), and Microsoft Purview.
Review and analyze security logs from SIEM, firewalls, antivirus, endpoint detection and response (EDR), and other monitoring systems.
Conduct vulnerability assessments and coordinate remediation efforts with infrastructure and desktop support teams.
Assist with the administration and enforcement of security policies, standards, and procedures.
Monitor phishing, malware, ransomware, and email security threats.
Perform compliance searches, email investigations, and security-related audits within Microsoft 365 and Exchange Online.
Support endpoint security management including BitLocker, Windows Defender, patch management, and endpoint hardening.
Assist with identity and access management (IAM), including Active Directory group memberships, privileged access reviews, and MFA enforcement.
Collaborate with IT teams to secure cloud infrastructure, servers, workstations, and applications.
Participate in disaster recovery, business continuity, and cybersecurity readiness planning.
Maintain documentation related to security incidents, procedures, configurations, and remediation efforts.
Assist with security awareness initiatives and end-user cybersecurity training.
Stay current with emerging cybersecurity threats, vulnerabilities, and industry best practices.
Ability to participate in after-hours support or incident response when necessary.
Ability to manage multiple priorities in a fast-paced environment.
Strong attention to detail and commitment to cybersecurity best practices.