Security Analyst - Project Lead

Novalink Solutions LLC•West Columbia, SC

About The Position

The Security Analyst - Project Lead reviews and correlates security event data from SIEM, EDR, IDS/IPS, and threat intelligence sources to identify attack patterns, emerging threats, and incidents. The role investigates suspicious activity, validates incidents, determines root cause and impact, and escalates critical incidents to Tier 3 with relevant context. It also produces incident reports, timelines, post-incident summaries, lessons-learned documentation, and remediation recommendations. The analyst investigates reported phishing, malware infections, and potential policy violations, and advises users and internal or external teams on containment and recovery. The role recommends improvements to SOC playbooks and workflows, tunes detection rules and alert thresholds, integrates threat intelligence feeds, and proactively hunts for threats using current tactics, techniques, and procedures. It also collaborates with engineering, SOC, and agency staff; documents SOC processes and runbooks; and serves as a customer-facing subject matter expert who demonstrates DIS services and helps resolve issues. Other duties may be assigned. Preference is given to candidates able to work onsite over hybrid or full-time remote arrangements. The interview process begins with an on-camera Microsoft Teams interview; an in-person interview is preferred before final selection.

Requirements

At least 2 years of experience with security monitoring and incident response.
At least 2 years of experience with the MITRE ATT&CK framework.
At least 2 years of experience creating dashboards and reports.
Associate degree in an information technology or information security-related field, or four years of relevant work experience in lieu of education.
Two years of experience supporting large SOC operations.

Nice To Haves

Experience with the Palo Alto Cortex XSIAM/XDR platform.
Knowledge of Linux, network administration, and network design.
Experience administering firewalls, VPN technology, Active Directory, and intrusion detection/prevention systems.
Local to Columbia, South Carolina, or a surrounding South Carolina city.
CISSP, CISA, CISO, or equivalent advanced security certification.
Additional relevant certifications such as CEH, OSCP, or GPEN.
Vendor certifications related to information security.
Ability to work onsite; onsite candidates are preferred over hybrid and full-time remote candidates.

Responsibilities

Review and correlate security event data across SIEM, EDR, IDS/IPS, and threat intelligence sources to identify attack patterns, emerging threats, and incidents.
Analyze suspicious activity, validate incidents, determine root cause and impact, and escalate critical incidents to Tier 3 with detailed context.
Prepare incident reports, timelines, and post-incident summaries; contribute to lessons-learned documentation and remediation recommendations.
Investigate reported phishing, malware infections, and potential policy violations, and advise relevant teams on containment and recovery.
Recommend SOC playbook and workflow updates based on investigations; tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve threat coverage.
Work with engineering teams to configure and tune monitoring tools, integrate threat intelligence feeds, and proactively hunt for threats using current TTPs.
Serve as a customer-facing subject matter expert by demonstrating DIS services and resolving issues.
Document SOC processes, runbooks, and troubleshooting steps.
Coordinate with engineering, SOC, and agency staff to meet goals.
Perform other duties as needed.