Cybersecurity Analyst

FrontLine Cyber Solutions Corporation is seeking a Cybersecurity Analyst to support the firm’s 24/7/365 Cyber Fusion Center. The role focuses on monitoring, detection, analysis, investigation, and mitigation of cyber threats across a range of customer IT and OT environments.

Role Overview

You will work with SIEM, EDR, and NDR technologies to perform incident response and threat hunting activities. Responsibilities include triaging alerts, analyzing security events and network traffic, supporting vulnerability assessment efforts, and assisting with security control validation across customer environments. The position includes contributions to documentation, incident reporting, and continuous improvement of cybersecurity monitoring capabilities.

Responsibilities

• Monitor, analyze, and investigate cybersecurity alerts and events generated by SIEM, EDR, NDR, firewalls, intrusion detection systems, and other security platforms.
• Support 24/7/365 Cyber Fusion Center operations by identifying and responding to potential security incidents across customer environments.
• Perform initial triage, investigation, escalation, and remediation of cybersecurity incidents according to established incident response procedures.
• Conduct threat hunting to identify suspicious behavior, malicious activity, indicators of compromise (IOCs), and potential security breaches.
• Analyze network traffic, security logs, endpoint telemetry, and packet captures (PCAP) to identify anomalous or malicious activity.
• Configure, maintain, and optimize SIEM platforms, including alerting rules, correlation logic, dashboards, and reporting capabilities.
• Deploy, configure, and manage EDR and NDR solutions to improve endpoint and network visibility.
• Assist with deployment, configuration, monitoring, and troubleshooting of Watcher Security Appliance and associated cybersecurity technologies.
• Conduct vulnerability assessments using industry-standard scanning and assessment tools to identify weaknesses in customer systems and networks.
• Analyze vulnerability scan results, prioritize risks, and provide actionable remediation recommendations.
• Assist with penetration testing, security assessments, and validation of cybersecurity controls.
• Investigate phishing activity, malicious emails, malware infections, unauthorized access attempts, and suspicious network communications.
• Monitor threat intelligence sources, including emerging vulnerabilities, attacker tactics, techniques, and procedures (TTPs), and indicators of compromise.
• Support incident response activities including containment, eradication, recovery, root cause analysis, and post-incident reporting.
• Review and analyze firewall configurations, access control policies, network segmentation, and security architecture.
• Support security hardening of Windows, Linux, Windows Server, Microsoft 365, and Active Directory environments.
• Evaluate endpoint security configurations, antivirus solutions, application controls, and security policies.
• Document security incidents, investigation findings, vulnerabilities, remediation activities, and technical procedures.
• Develop and maintain incident response playbooks, standard operating procedures (SOPs), and cybersecurity monitoring documentation.
• Prepare detailed security reports, incident summaries, and recommendations for internal teams and customers.
• Collaborate with the Technical Operations Center (TOC), cybersecurity engineers, and customer IT personnel to resolve security issues.
• Participate in cybersecurity research, detection engineering, and continuous improvement of security monitoring capabilities.
• Support integration of cybersecurity tools, threat intelligence feeds, and automated response capabilities.
• Participate in an on-call rotation and provide after-hours support for cybersecurity incidents when required.

Required Experience and Certifications

• Experience: 2 years in a system security role (Required).
• CompTIA Security+: Required.
• CompTIA Network+: Required.
• Education: Associate (Preferred).
• Shift requirements: Overnight Shift (Required).

Additional Requirements

• Willingness to participate in rotating shifts, after-hours incident response, or on-call support as required.
• Strong understanding of cybersecurity principles, security operations, incident response, and threat detection methodologies.
• Experience with SIEM platforms such as Microsoft Sentinel, Splunk, RocketCyber, or similar technologies.
• Familiarity with EDR and endpoint security solutions such as CrowdStrike, Microsoft Defender for Endpoint, WatchGuard EDR, or similar platforms.
• Understanding of NDR, IDS, and IPS.
• Strong knowledge of networking fundamentals including TCP/IP, DNS, DHCP, HTTP/HTTPS, VPNs, VLANs, routing, switching, and network segmentation.
• Experience analyzing network traffic using Wireshark, tcpdump, or similar packet analysis tools.
• Understanding of firewalls, ACLs, VPN technologies, and network security architecture.
• Experience with Windows, Windows Server, and Linux operating systems.
• Familiarity with Microsoft 365 security administration, Microsoft Entra ID, Active Directory, Group Policy, and identity and access management.
• Understanding of authentication protocols, MFA, conditional access, and privileged access management.
• Experience investigating malware, phishing attacks, suspicious network activity, and unauthorized access attempts.
• Knowledge of vulnerability scanning tools such as Nessus, OpenVAS, Qualys, or similar technologies.
• Familiarity with penetration testing and security assessment tools such as Nmap, Kali Linux, Metasploit, and Burp Suite.
• Understanding of the MITRE ATT&CK framework and Cyber Kill Chain, including common attacker TTPs.
• Familiarity with incident response processes, forensic evidence collection, and root cause analysis.
• Understanding of security logging, event correlation, alert tuning, and detection engineering.
• Ability to communicate technical findings and cybersecurity risks clearly to technical and nontechnical audiences.
• Strong organizational skills to manage multiple investigations and priorities simultaneously.
• Ability to work independently while contributing effectively to a collaborative cybersecurity operations team.
• Ability to maintain confidentiality and handle sensitive customer information appropriately.

Technologies

• Security Information and Event Management (SIEM): Microsoft Sentinel, Splunk, RocketCyber
• Endpoint Detection and Response (EDR): CrowdStrike, Microsoft Defender for Endpoint, WatchGuard EDR
• Network Detection and Response (NDR), Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS)
• Networking and analysis: Wireshark, tcpdump, TCP/IP, DNS, DHCP, HTTP/HTTPS, VPNs, VLANs, Firewalls, Access control lists (ACLs), packet captures (PCAP)
• Platforms and environments: Windows, Windows Server, Linux, Microsoft 365, Microsoft Entra ID, Active Directory, Group Policy
• Security and assessment tools: Nessus, OpenVAS, Qualys, Nmap, Kali Linux, Metasploit, Burp Suite
• Frameworks and methods: MITRE ATT&CK framework, Cyber Kill Chain, TTPs
• Automation and scripting: Python, PowerShell, Bash
• Other: Microsoft Azure, Watcher’s Security Appliance

Benefits

• 401(k)
• Dental insurance
• Health insurance
• Paid time off
• Tuition reimbursement
• Vision insurance

Compensation

$50,000 - $75,000 per year (USD), with pay listed as $50,000.00 - $75,000.00 per year.

Job Type and Location

• Job type: Full-time, Permanent
• Work location: Idaho Falls, ID (onsite)
• Work location (listed): Hybrid remote in Idaho Falls, ID 83404