Senior Security Analyst

Brown & Brown Insurance•Daytona Beach, FL

1d•Hybrid

About The Position

The Security Analyst supports the organization’s security posture through continuous monitoring, analysis, investigation, and response to cybersecurity threats and suspicious activity. This position within the Office of the CISO focuses on security operations, threat intelligence, incident triage, alert validation, log analysis, and coordination across security and technology teams to improve detection and response capabilities. The Security Analyst reports directly to the Global Director of Security Operations and Incident Response and helps the organization prevent, detect, contain, and respond to threats through disciplined analysis, documentation, and operational support. In addition, the security analyst is responsible for various security improvement projects.

Requirements

B.S. in Information Security, Computer Science, Computer Engineering or similar technical program or equivalent experience
At least one active security certification preferred: GCIH, GCIA, CISSP, CEH or related
Preferred experience using CrowdStrike, Google SecOps, Microsoft Log Analytics, and ServiceNow.
7+ years in a security operations, incident response, threat monitoring, or cyber defense role supporting a large organization
Working knowledge of security monitoring and investigative technologies such as SIEM, EDR, IDS/IPS, DLP, vulnerability management, email security, and threat intelligence platforms
Strong understanding of security operations concepts such as incident triage, alert validation, threat intelligence, kill-chain analysis, insider threat, risk assessment, and security metrics
Familiarity with attack paths, threat vectors, attacker TTPs, indicators of compromise, and investigative methodologies
Working knowledge of information security best practices, incident handling procedures, and common security frameworks such as NIST and MITRE ATT&CK
Experience investigating activity in Microsoft security ecosystems, including Entra ID, Defender, and related cloud or hybrid environments preferred
Experience with writing queries, analyzing logs, building reports, or using basic scripting for investigations and operational efficiency preferred

Responsibilities

Monitor security alerts, events, and logs across endpoint, network, cloud, identity, email, and application security platforms
Perform security triage, analysis, and investigation of suspicious activity to determine scope, impact, and appropriate response actions
Validate and escalate security incidents in accordance with incident response procedures, ensuring timely communication and documentation
Analyze data from SIEM, EDR, IDS/IPS, DLP, email security, and other monitoring tools to identify malicious or anomalous behavior
Support incident response activities by collecting forensic evidence, preserving artifacts, analyzing forensic artifacts, tracking actions, and assisting with containment and recovery efforts
Leverage threat intelligence sources and internal context to assess emerging threats, attacker tactics, and indicators of compromise relevant to the organization
Review and tune detection content, use cases, and alert logic in partnership with engineering and platform teams to improve detection quality and reduce false positives
Conduct recurring and ad hoc threat hunting activities using logs, endpoint telemetry, and threat intelligence to identify previously undetected threats
Track, document, and report security incidents, investigative findings, trends, and operational metrics to support management reporting and continuous improvement
Assist with vulnerability, exposure, and risk-related analysis by correlating findings with threat activity and business impact