IT - ADMIN - Security Analyst - Project Lead

Abacus•Columbia, SC

3d•Remote

About The Position

The State of South Carolina’s Division of Information Security is seeking a Security Analyst to support statewide security incident response as a Tier 2 SOC Analyst. The role focuses on security monitoring, threat detection, incident response, and investigations, while working directly with state agencies to promote and improve adoption of centralized security services. The engagement is expected to last 12 months, with the possibility of extension. The position is listed as remote, with no South Carolina residency requirement and candidates nationwide considered, provided they can work Eastern Time hours. Preference is given to candidates who can work onsite in Columbia, South Carolina, as needed; onsite candidates are preferred over hybrid and fully remote candidates. Travel-related costs for onsite work are the resource’s responsibility. The listed primary work location is 4430 Broad River Road, Columbia, South Carolina. The work schedule is 40 hours per week, 8:00 a.m. to 5:00 p.m., day shift. The position requires a security check and listed pre-employment checks include drug, driving, credit, criminal, E-Verify, and SLED checks.

Requirements

At least 2 years of experience with security monitoring and incident response.
At least 2 years of experience with the MITRE ATT&CK framework.
At least 2 years of experience creating dashboards and reports.
An associate degree in an information technology or information security-related field, or four years of relevant work experience in lieu of education.
At least 2 years of experience supporting large SOC operations.
Ability to work Eastern Time hours.
Security clearance/check required.
Work is 40 hours per week; travel costs for onsite work are the resource’s responsibility.

Nice To Haves

Experience with the Palo Alto Cortex XSIAM/XDR platform.
Knowledge of Linux, network administration, and network design.
Experience administering firewalls, VPN technology, Active Directory, and intrusion detection/prevention systems.
Local to Columbia, South Carolina, or a surrounding city.
CISSP, CISA, CISO, or equivalent advanced security certification.
Additional relevant certifications such as CEH, OSCP, or GPEN.
Vendor certifications related to information security.
Ability to work onsite as needed; preference is given to onsite availability over hybrid or fully remote work.

Responsibilities

Review and correlate security event data across SIEM, EDR, IDS/IPS, and threat intelligence sources to identify complex attack patterns, emerging threats, and security incidents.
Conduct in-depth analysis of suspicious activity, validate incidents, determine root cause and impact, and escalate critical incidents to Tier 3 with detailed context as needed.
Prepare incident reports, timelines, and post-incident summaries; contribute to lessons-learned documentation and recommendations for remediation and prevention.
Investigate reported phishing, malware infections, and potential policy violations, and advise users and internal or external teams on containment and recovery.
Recommend improvements to SOC playbooks and workflows based on investigations, and tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve threat coverage.
Work with engineering teams to configure and tune monitoring tools, integrate threat intelligence feeds into workflows, and proactively hunt for threats using current tactics, techniques, and procedures.
Serve as a customer-facing subject matter expert by demonstrating client service capabilities and resolving issues.
Document SOC processes, runbooks, and troubleshooting steps.
Coordinate with engineering, SOC, and agency staff to meet goals.
Perform other duties as needed.