Tier 2 Security Analyst

WEBIT Services•Naperville, IL

About The Position

WEBIT Services is an employee-owned Managed Services Provider seeking a Tier 2 Security Analyst to protect client environments and improve the quality of security work across its Naperville, Illinois team. The analyst is the working core of WEBIT's security function, leading security incident response from containment and investigation through remediation, managing SIEM/MDR alert tuning and detection rules, overseeing vulnerability management for assigned clients, and authoring runbooks for Tier 1 analysts. This hands-on role turns alerts into confirmed findings, findings into remediation tickets, and resolved tickets into runbooks that other analysts can follow. The analyst also leads incident bridges and post-incident reviews, communicates with clients, administers security policies, presents quarterly reviews, and documents evidence for audits and reviews.

Requirements

Formal education is not required; relevant certifications and demonstrated competency also apply.
At least 2 years of experience in IT support or security operations, including 1 year investigating and responding to security alerts or incidents.
Hands-on experience with an EDR/MDR platform, Microsoft 365, Defender, and Entra ID.
Ability to explain security findings to non-technical client contacts.
Ability to work autonomously, act proactively, and meet KPIs.

Nice To Haves

Prior MSP experience, including multi-tenant environments, SLA-driven delivery, and PSA workflows.
Certifications such as CompTIA Security+, Microsoft SC-900, CompTIA CySA+, Microsoft SC-200, CompTIA Network+, Microsoft AZ-900, or certifications for EDR/MDR platforms.

Responsibilities

Lead incident response for security events, including containment, investigation, eradication, remediation, and documentation to a reviewable standard.
Run incident bridges, keep affected clients informed, and lead post-incident reviews.
Manage SIEM/MDR alert tuning and detection rules for assigned clients, reducing noise without reducing coverage.
Investigate escalated alerts from the EDR/MDR platform, Microsoft 365 Defender, Entra ID sign-in logs, and the email security platform.
Administer EDR policies and exclusions and the email security rule set.
Manage the assigned client vulnerability lifecycle: scan, prioritize, open remediation tickets for the Help Desk and Field Teams, and track tickets to closure.
Verify MFA, Conditional Access, and backup status; prioritize by risk and remediate gaps against the WEBIT security baseline.
Perform remediation according to client frameworks and document evidence for audits and reviews.
Lead quarterly reviews and present findings.
Implement Conditional Access, MFA, and Intune security policy changes to standards.
Write SOPs and drive process improvement.