Cybersecurity Investigator

The Cybersecurity Investigator protects BlueScope Steel North America Corporation’s information assets by monitoring, investigating, containing, and responding to cybersecurity threats. This onsite role in Kansas City, MO serves as an experienced Security Operations Center analyst and escalation resource for complex events across enterprise and cloud environments.

Responsibilities

• Monitor and investigate security events and alerts from SIEM, endpoint detection and response, identity, email, cloud, network, and other cybersecurity technologies.
• Conduct advanced triage and analysis of suspicious activity, potential policy violations, and confirmed security incidents.
• Analyze telemetry across endpoint, identity, application, cloud, and network sources to determine incident scope, impact, and likely root cause.
• Correlate security telemetry, threat intelligence, and contextual information to separate malicious behavior from expected business operations.
• Record investigative actions, evidence, findings, and conclusions in a clear and repeatable format.
• Act as an escalation point for complex or high-risk investigations and provide guidance to less-experienced analysts.
• Coordinate and perform incident response activities, including identification, containment, eradication, recovery, and post-incident review.
• Investigate incidents including phishing, malware, ransomware, account compromise, insider threat, unauthorized access, and data loss.
• Collect and preserve relevant evidence in line with established procedures and applicable legal or regulatory requirements.
• Develop, maintain, and improve incident response playbooks, investigation procedures, and escalation workflows.
• Coordinate remediation activities with infrastructure, identity, application, cloud, networking, legal, human resources, and business stakeholders.
• Provide timely status updates and communicate incident risk, business impact, decisions, and required actions.
• Perform proactive threat hunting to identify suspicious behaviors or indicators that may not generate traditional security alerts.
• Use the MITRE ATT&CK framework and threat intelligence to evaluate adversary tactics, techniques, and procedures.
• Recommend and assist with detection use cases, correlation rules, hunting queries, dashboards, and investigation workflows.
• Tune detections to improve fidelity, reduce unnecessary alert volume, and strengthen threat coverage.
• Validate security controls and detections through investigative feedback, testing, and lessons learned from incidents.
• Identify recurring investigation patterns and recommend automation, orchestration, and process improvements.
• Develop and maintain operational metrics, case reporting, and trend analysis for security monitoring and incident response activities.
• Contribute to security operations procedures, knowledge articles, and analyst training materials.
• Support major incident exercises, tabletop exercises, and continuous improvement activities.
• Assist with cybersecurity assessments, audit requests, and risk-reduction initiatives as needed.
• Collaborate with global and regional security, infrastructure, networking, identity, application, cloud, and operational technology teams.
• Prepare clear investigation reports, incident summaries, and executive-ready communications appropriate to the audience.
• Share investigative knowledge, mentor developing analysts, and promote consistent security operations practices.
• Build relationships with internal stakeholders and external security service providers.
• Maintain awareness of emerging threats, attacker behaviors, defensive technologies, and investigative techniques.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline; or equivalent education and practical experience.
• 4+ years of experience in cybersecurity, security operations, incident response, threat hunting, digital forensics, or cyber investigations.
• Experience working in a Security Operations Center or comparable security monitoring and response environment.
• Hands-on experience investigating alerts and incidents using SIEM, endpoint detection and response, identity, email, cloud, and network security technologies.
• Strong knowledge of Windows, Active Directory, Microsoft Entra ID, Microsoft 365, networking, authentication, and security event analysis.
• Experience investigating phishing, malware, ransomware, account compromise, insider threat, unauthorized access, or data protection incidents.
• Knowledge of incident response methodologies, evidence handling, threat intelligence, and the MITRE ATT&CK framework.
• Ability to analyze complex technical information, reach defensible conclusions, and communicate findings to technical and non-technical stakeholders.
• Strong written communication, documentation, organizational, troubleshooting, and problem-solving skills.
• Ability to participate in an on-call or after-hours response rotation when required for critical cybersecurity incidents.

Technologies

SIEM, endpoint detection and response, Active Directory, Microsoft Entra ID, Microsoft 365, MITRE ATT&CK, Windows, Microsoft Azure, GCIH, GCIA, GCFA, CySA+, SC-200, CISSP, SIEAM, XDR, SASE

Benefits

• Health insurance
• Life insurance
• Short and long term disability
• Paid time off
• Retirement

Desired Qualifications

• Certifications such as GCIH, GCIA, GCFA, CySA+, SC-200, CISSP, or comparable security credentials.
• Experience with SIEAM, XDR, SASE, or similar security operations platforms.
• Experience conducting cloud security investigations in Microsoft Azure or other cloud environments.
• Familiarity with digital forensics, memory or disk analysis, malware analysis, and evidence preservation practices.
• Experience creating detection rules, threat hunting queries, security automation, or orchestration workflows.
• Experience supporting manufacturing, industrial, critical infrastructure, or operational technology environments.
• Experience coordinating investigations with managed security service providers, legal teams, human resources, or law enforcement.

Skills and Abilities

• Driver of Future Readiness
• Creative Problem Solver
• Change Facilitator
• Results Achiever
• Driver of Commercial Success
• Builder of Customer Value
• Collaborative Partner
• Capability Builder

Work Environment

• This position is part of BlueScope North America and supports cybersecurity monitoring, investigations, and incident response activities.
• Collaboration with stakeholders across multiple BlueScope businesses, regions, and time zones.
• On-call rotation or work outside normal business hours may be required to support critical cybersecurity incidents.
• BlueScope embraces flexible working arrangements where possible and mutually agreed.

Additional Information

The listed responsibilities and tasks indicate the general nature and level of work performed and may not be a comprehensive inventory of duties. Other duties may be assigned, and additional job competencies, individual goals, and performance measurements are set at the department level.