Threat Investigation Analyst

Sentinel•Downers Grove, IL

1d•$60,000 - $65,000•Hybrid

About The Position

The Threat Investigation Analyst is a key member of the Threat Operations Team and serves as a first responder to cybersecurity incidents. This role is responsible for triaging, investigating, and responding to security alerts to protect customer environments. Analysts evaluate real-world logs, network traffic, and security artifacts to determine malicious versus benign activity and communicate findings clearly to both technical and non-technical stakeholders. This position can be remote, with occasional onsite support required at our Downers Grove, IL headquarters.

Requirements

CompTIA Security+ certification
Experience with SIEM platforms and security investigations
Familiarity with network, endpoint, and host-based security telemetry
Understanding of common and emerging attack techniques
Understanding basic network protocols and traffic flow in an enterprise environment
Strong attention to detail and documentation accuracy
The ability to communicate clearly with verbal and written skills
Must be able to meet and uphold CJIS requirements
Must have a car, as this position requires travel between location and the transportation of equipment
A valid driver’s license and proof of vehicle insurance will be required
Legally authorized to work in the US without sponsorship
Must demonstrate a “can-do” attitude

Nice To Haves

1+ years of experience in a Security Operations role (SOC, Incident Response, Threat Intel, Malware Analysis, IDS/IPS, etc.) preferred

Responsibilities

Triaging, investigating, and responding to security alerts to protect customer environments.
Evaluating real-world logs, network traffic, and security artifacts to determine malicious versus benign activity.
Communicating findings clearly to both technical and non-technical stakeholders.
Shadowing live security investigations and incident response activities.
Learning customer environments, security tools, workflows, and response procedures.
Developing proficiency in investigation, escalation, documentation, and communication processes.
Performing daily system monitoring and health checks for various security products.
Triage alerts and reports of incidents.