Tier 2 Security Analyst

WEBIT Services•Naperville, IL

5d•$75,000 - $90,000

About The Position

8WEBIT Services is an employee-owned Managed Services Provider seeking a Tier 2 Security Analyst to protect client environments and improve the quality of security work across its Naperville, Illinois team. This hands-on role is the working core of the security function. The analyst leads security incident response from containment and investigation through remediation, manages SIEM/MDR alert tuning and detection rules, oversees assigned clients’ vulnerability management, and creates runbooks for Tier 1 analysts. The role turns alerts into confirmed findings, findings into remediation tickets, and resolved tickets into documented procedures that others can follow.

Requirements

Formal education is not required; relevant certifications and demonstrated competency may also qualify.
At least 2 years of experience in IT support or security operations, including 1 year investigating and responding to security alerts or incidents.
Hands-on experience with an EDR/MDR platform, Microsoft 365, Defender, and Entra ID.
Ability to explain a security finding to a non-technical client contact.
Work autonomously, act proactively, and meet KPIs.

Nice To Haves

Prior MSP experience, including multi-tenant environments, SLA-driven delivery, and PSA workflows.
Certifications such as CompTIA Security+, Microsoft SC-900, CompTIA CySA+, Microsoft SC-200, CompTIA Network+, Microsoft AZ-900, or certifications for EDR/MDR platforms.

Responsibilities

Lead security incident response from containment and investigation through eradication and remediation, and document each incident to a reviewable standard.
Run incident bridges, keep affected clients informed, and lead post-incident reviews.
Manage SIEM/MDR alert tuning and detection rules for assigned clients, reducing noise without reducing coverage.
Investigate escalated alerts from the EDR/MDR platform, Microsoft 365 Defender, Entra ID sign-in logs, and the email security platform.
Administer EDR policies and exclusions and the email security rule set.
Manage assigned clients’ vulnerability lifecycle: scan, prioritize, open remediation tickets for Help Desk and Field Teams, and track tickets to closure.
Verify MFA, Conditional Access, and backup status; prioritize by risk and remediate gaps against the WEBIT security baseline.
Perform remediation according to client frameworks and document evidence for audits and reviews.
Lead quarterly reviews and present findings.
Implement Conditional Access, MFA, and Intune security policy changes to standards.
Write SOPs and drive process improvement.