Security Operations Analyst

Qnity•Elsmere, DE

12h•Hybrid

About The Position

Qnity is seeking a hands-on Security Operations Analyst to support monitoring, investigation, and response to cybersecurity threats across the enterprise. The role investigates security events across endpoint, identity, email, cloud, network, application, and data protection environments, and coordinates appropriate containment and remediation activities. The analyst works closely with internal technology teams and managed security service providers to investigate incidents, improve security monitoring, and help protect Qnity’s users, systems, and information. The successful candidate demonstrates strong analytical judgment, takes ownership of investigations through resolution or escalation, collaborates effectively across technical and business teams, and continually looks for opportunities to improve Qnity’s detection and response capabilities. The role also reflects Qnity’s values of customer partnership, innovation, speed, and collaboration.

Requirements

3 to 5+ years of relevant cybersecurity experience, including security operations, incident response, or SOC operations.
Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, a related discipline, or equivalent practical experience.

Nice To Haves

Experience with enterprise security technologies, particularly within the Microsoft security ecosystem.
Experience working within a co-managed SOC or MSSP operating model.
Working knowledge of the MITRE ATT&CK framework.
Relevant certifications such as CompTIA Security+, CySA+, Microsoft SC-200, GIAC GCIH, GCIA, or comparable certifications.

Responsibilities

Monitor, triage, investigate, and document cybersecurity alerts and incidents.
Analyze security events across endpoint, identity, email, network, cloud, application, and data protection environments.
Correlate security telemetry to determine the scope, severity, and potential impact of suspicious activity.
Support incident containment, remediation, recovery, and post-incident activities.
Investigate phishing, business email compromise, malicious URLs and attachments, spoofing, compromised accounts, and other email-based threats.
Coordinate email and DLP remediation activities with appropriate technical, business, Legal, Privacy, or other stakeholders.
Perform targeted threat hunting using available security telemetry and indicators of compromise.
Develop and execute security queries to identify suspicious activity and determine potentially affected users, accounts, endpoints, and systems.
Review and validate investigations escalated by managed security service providers and coordinate follow-up actions with Qnity teams.
Identify opportunities to improve detection effectiveness, investigation processes, playbooks, and security controls.
Maintain accurate incident records, investigation findings, remediation activities, and operational documentation.