Network Security Analyst 2, Cybersecurity

the Opportunity•Austin, TX

21h•Onsite

About The Position

Our client is seeking an experienced Network Security Analyst 2 to support enterprise cybersecurity and security operations in Austin, Texas. This is a hands-on cybersecurity position responsible for monitoring, detecting, investigating, and responding to security events across network, endpoint, cloud, and enterprise environments. The ideal candidate will bring extensive experience with SIEM, SOAR, EDR, XDR, NDR, Microsoft Sentinel, KQL, SPL, threat intelligence, detection engineering, and incident response. This position requires strong technical judgment, analytical skills, attention to detail, and the ability to independently investigate and respond to complex security events.

Requirements

Minimum of 7 years of experience in cybersecurity, network security, security operations, incident response, or a closely related information security discipline.
Strong hands-on experience in SIEM, SOAR, EDR, XDR, and NDR technologies
Microsoft Sentinel SIEM platform and architecture support
Security log collection and management
Threat intelligence concepts and analysis
Detection engineering methodology and implementation
Incident investigation and response
Security event correlation and analysis
Network traffic analysis
Endpoint security investigation
Security monitoring and alert management
Hands-on experience with Microsoft Sentinel, including: Incident management, Analytics rules, Workbooks and dashboards, Automation, Data connectors, Kusto Query Language, KQL, Alert investigation and correlation, Security monitoring, Log analysis
Experience writing and interpreting KQL, SPL, and other security queries used for investigations, threat hunting, reporting, and detection engineering.
Strong working knowledge of Firewalls, IDS/IPS, Proxy logs, DNS, VPN technologies, TCP/IP, Network segmentation, Secure network architecture, Network Detection and Response (NDR), Endpoint Detection and Response (EDR), Packet and session analysis, Endpoint alert triage, Device investigation, Advanced threat hunting, Endpoint response actions
Knowledge of commonly used cybersecurity frameworks, controls, and regulatory requirements, including: NIST, CIS Controls, HIPAA, Enterprise information security standards and requirements, Security risk and control assessment practices.

Nice To Haves

10+ years of experience in SIEM, SOAR, EDR, XDR, and NDR
Security log collection and management
Threat intelligence
KQL and SPL query development
SIEM platform and architecture support
Detection engineering and implementation
Previous experience supporting healthcare, government, public-sector, or other highly regulated enterprise environments
Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, or a related technical discipline
Microsoft security certifications (Microsoft Certified: Security Operations Analyst Associate, Microsoft Certified: Cybersecurity Architect Expert, Microsoft Certified: Azure Security Engineer Associate, Microsoft security and Defender-related certifications)
CompTIA Security+
CompTIA CySA+
CISSP
CISM
CISA
GIAC security certifications
Splunk Core Certified Power User
Splunk Enterprise Security certifications
SentinelOne product certifications

Responsibilities

Monitor security alerts, logs, network events, endpoint telemetry, and threat intelligence feeds.
Analyze suspicious activity, anomalous network behavior, malware indicators, endpoint detections, and SIEM correlation events.
Determine the scope, severity, potential impact, and appropriate response to cybersecurity incidents.
Perform incident triage, investigation, escalation, containment coordination, remediation support, and documentation.
Develop, tune, and maintain security detection rules, dashboards, alerts, queries, and automated response playbooks.
Improve security visibility across network, endpoint, identity, cloud, and enterprise environments.
Conduct threat-hunting activities using KQL, SPL, packet and session analysis, endpoint telemetry, and other investigative techniques.
Identify indicators of compromise, attacker tactics, suspicious network patterns, and endpoint-based threats.
Analyze and correlate security information across multiple systems and data sources.
Support vulnerability, risk, and security control assessments for network infrastructure and enterprise information systems.
Investigate security breaches and identify root causes, affected systems, and appropriate corrective actions.
Collaborate with network, infrastructure, cloud, endpoint, and application teams to validate security events and implement risk-mitigation measures.
Document investigation findings and prepare clear incident reports, corrective actions, metrics, and technical recommendations.
Support compliance, audit, and reporting activities by providing security documentation, evidence, and operational metrics.
Maintain awareness of emerging cyber threats, attack techniques, vulnerabilities, indicators of compromise, and cybersecurity best practices.
Support the security and integrity of systems that process, store, or transmit sensitive information.
Participate in incident response, escalation, and post-incident review activities.
Maintain accurate operational documentation and investigation notes.