IT Security Operations Analyst

HEICO Corporation•Hollywood, FL

About The Position

The Senior IT Security Analyst applies advanced systems analysis techniques and deep cybersecurity operations expertise to protect sensitive and mission-critical systems across HEICO and its subsidiaries. This role serves as a senior technical escalation point for security monitoring and incident response, leads complex investigations, and drives continuous improvement of detection, response, and security hardening capabilities. The Senior IT Security Analyst acts as a trusted advisor and liaison to ensure security operations align with HEICO standards while accounting for subsidiary-specific business needs and technical nuances. The role mentors junior analysts, improves operational rigor (playbooks, automation, metrics), and supports compliance-driven security requirements through disciplined execution and documentation.

Requirements

Bachelor’s degree in Computer Science, Computer Engineering, Information Technology, Cybersecurity, or a related field; or an equivalent combination of education and professional experience.
Minimum five (5) years of progressively responsible experience in cybersecurity operations, incident response, or closely related IT security roles.
Prior experience working in or closely supporting a Security Operations Center (SOC) environment, including incident handling under time pressure.
Demonstrated experience leading incident investigations end-to-end (triage, containment, eradication, recovery validation, post-incident improvement).
Strong working knowledge of: Windows, macOS, and Linux operating system security, hardening practices, and configuration analysis
TCP/IP networking fundamentals and common enterprise network services/protocols
Enterprise security tooling such as EDR/XDR, SIEM/log analysis, identity security, and vulnerability management
Experience developing or implementing automation (SOAR or scripted workflows) to improve operational response.
Proven ability to document technical findings clearly, communicate effectively with technical and non-technical stakeholders, and drive work to closure across teams.
Ability to manage multiple priorities and perform effectively during time-sensitive security events.
Willingness and ability to travel to supported sites as needed.

Nice To Haves

Advanced certifications such as CISSP, GIAC (e.g., GCIH/GCIA/GCED), OffSec (e.g., OSCP/related), CASP+, or comparable expert-level credentials.
Experience mapping detections/hunts to common threat frameworks (e.g., MITRE ATT&CK) and improving detection coverage.
Practical understanding of how technical security controls support regulatory/contractual needs (e.g., SOX and NIST SP 800-171), including evidence and audit readiness.
Experience improving security programs through metrics/KPIs, playbooks/runbooks, tabletop exercises, and continuous improvement cycles.
Experience engaging third-party providers/MSPs on security requirements, incident handling expectations, and remediation follow-through.
Familiarity with hybrid and virtualized infrastructure environments and applying security controls across those platforms.

Responsibilities

Analyze and triage security alerts from managed detection and response (MDR) services and internal monitoring platforms; determine severity, scope, and required actions.
Serve as an escalation point for high-impact or complex alerts and investigations; provide guidance to junior analysts during active cases.
Lead cybersecurity incident investigations, including evidence preservation, containment, eradication, and recovery validation in accordance with established procedures.
Coordinate incident communications and technical actions across IT teams, impacted sites, and third-party providers; ensure timely escalation when elevated authorization is required.
Perform post-incident reviews, document timelines and lessons learned, and implement improvements to reduce recurrence.
Conduct malware and suspicious artifact analysis using investigative tooling (including sandboxing) to determine behavior, impact, and mitigation steps.
Perform proactive threat hunting to identify stealthy or low-signal adversary activity and improve detection coverage.
Evaluate, tune, and optimize EDR/XDR detection logic, response policies, and automated containment actions to improve efficacy and reduce false positives.
Enhance alert fidelity and investigative effectiveness through rule refinement, contextual enrichment, telemetry validation, and playbook improvements.
Design and maintain application control and endpoint protection policies to strengthen visibility, restrict unauthorized software execution, and address detection or response gaps.
Develop, test, and implement SOAR/security automation workflows to improve response consistency and enable action when staffing is limited.
Identify repetitive analyst tasks and implement automation to increase operational capacity and reduce mean time to respond (MTTR).
Escalate vulnerabilities or control weaknesses identified during incident response or threat hunting, providing technical impact analysis and attack-path context to the vulnerability management function.
Confirm that remediation actions adequately address the specific incident vector or exploited control gap.
Provide operational feedback on control effectiveness based on real-world incident activity and detection gaps (including emerging technology guidance such as AI usage controls).
Recommend improvements to technical safeguards or enforcement mechanisms when investigative findings reveal system weaknesses (e.g., SOX and NIST-aligned requirements).
Engage third-party IT providers/MSPs to communicate HEICO security requirements and incident handling expectations (including evidence retention).
Assess MSP execution against requirements, identify gaps, and escalate non-compliance through appropriate channels.
Act as a liaison between HEICO Corporate security and supported subsidiaries to maintain alignment on security initiatives, upgrades, and operational expectations.
Provide regular operational reporting (risk trends, incident metrics, remediation status, tooling effectiveness).
Required quarterly travel to supported out-of-state sites (i.e. quarterly planned visits and additional travel during escalations) to understand environment baselines, strengthen stakeholder relationships, and improve response readiness.
Participate in an on-call rotation and respond independently to security events outside standard business hours.
Perform other professional cybersecurity duties consistent with the scope and level of the position.