Security Siem

Security Siem Cybersecurity Jobs

3 jobs found

Today

Cybersecurity Analyst I

Pine & Harbor Retail Co. Atlanta, GA

Atlanta, GA

Today

$74k - $90k/yr Full time Cyber Security Cybersecurity Tools Endpoint Security

Apply Now

Job Description

Pine & Harbor Retail Co. is seeking a Cybersecurity Analyst I to support security operations in Atlanta, GA (hybrid). In this role, you will help keep detections actionable by monitoring alerts, investigating suspicious activity, and maintaining clear documentation as incidents move through established response procedures.

You will work across security monitoring, endpoint protection, identity, and email security signals, and you will also contribute to vulnerability and access-review activities. A rotating on-call assignment begins after training and includes defined response expectations, escalation paths, and an on-call stipend.

What you will do

Review and triage alerts from security monitoring, endpoint protection, identity, and email-security tools.
Investigate suspicious sign-ins, malware detections, phishing reports, and unusual device activity.
Document findings, actions, and escalation decisions in the case-management system.
Escalate confirmed or high-risk incidents to senior security team members using established procedures.
Support vulnerability findings by helping confirm assigned remediation work is completed.
Assist with access reviews, multifactor-authentication administration, and security checks for new systems.
Participate in phishing simulations, employee security awareness activities, and incident-response exercises.
Maintain investigation guides and recommend improvements when procedures are unclear or incomplete.
Coordinate with IT support, infrastructure, and application teams to resolve security issues.

What you bring

At least 1 year of experience in cybersecurity, IT support, systems administration, network support, or a closely related technical role.
Basic understanding of Windows, networking, user accounts, authentication, and common security threats.
Ability to review technical information carefully and explain findings clearly in written form.
Experience working with tickets, alerts, or documented support procedures.
Willingness to participate in the on-call rotation after completing training.
Authorization to work in the United States without current or future employer sponsorship.
Familiarity with Microsoft Sentinel, Microsoft Defender, Entra ID, Splunk, CrowdStrike, or another SIEM or endpoint-security platform is helpful.

Technologies you may work with

Microsoft Sentinel, Microsoft Defender, Entra ID, Splunk, CrowdStrike
SIEM, endpoint-security, multifactor-authentication
Windows, phishing simulations

On-call schedule and rotation details

After the first 90 days, analysts join an on-call rotation approximately one week every eight weeks.
During off-hours high-severity alerts, you respond remotely and can escalate to the senior analyst or Security Operations Manager.
On-call work typically requires fewer than three hours outside normal hours during an assigned week.
Each rotation includes a $300 stipend.
If an incident requires substantial overnight work, the following day’s schedule is adjusted in consultation with your manager.
Planned maintenance and incident-response exercises may occasionally occur outside regular hours, with advance notice when timing can be planned.

Compensation and bonus

Base salary: $74,000–$90,000 per year, depending on relevant experience and demonstrated technical skills.
Annual bonus: target bonus of 7% based on individual and company performance.
Actual bonus payment may range from 0% to 10.5% based on documented individual objectives and company performance.

Benefits

Medical, dental, and vision coverage with company premium contributions
HSA option with an employer contribution
Access to virtual primary and mental-health care
401(k) plan with a dollar-for-dollar company match on the first 4% of eligible compensation
17 days of paid time off
10 company holidays
Paid sick leave
Two company-wide wellness days
Twelve weeks of paid parental leave
Company-paid life insurance
Short- and long-term disability coverage
Up to $2,500 annually for approved certifications, technical courses, conferences, and exam fees
Dedicated study time for an agreed certification
Company-provided laptop and home-office equipment
Monthly internet reimbursement
An Atlanta public-transit benefit
Employee assistance and financial-planning resources
Discounts on products sold by Pine & Harbor brands
Relocation assistance

How success is measured

During the first 90 days: complete system training, shadow active investigations, and start handling lower-risk alerts with review from an experienced analyst.
By six months: investigate routine alerts independently, recognize when escalation is needed, maintain clear case documentation, and contribute to vulnerability and access-review work.
Performance evaluation includes investigation accuracy, appropriate escalation, documentation quality, response times, collaboration, and progress developing technical knowledge.
Analysts are not rewarded for closing alerts without adequate review.

Hiring process

30-minute introductory call with a Technology Recruiter
45-minute interview with the Security Operations Manager covering technical background, career interests, and on-call availability
60-minute live practical interview using an anonymized sample security alert
45-minute team interview with a Security Analyst and an IT Systems Engineer
Final reference checks, followed by a conditional written offer, employment verification, and a standard background check appropriate for a role with access to company systems

View full job page →

Today

Cyber Security Engineer

Trystar Inc Burnsville, MN

Burnsville, MN

Today

$130k - $160k/yr Full time Azure Azure Ad / Entra Id Cloud

Apply Now

Job Description

Trystar Inc is seeking a Cyber Security Engineer in Burnsville, MN to help lead the design, implementation, monitoring, and continuous improvement of its cybersecurity program. This onsite role offers technical leadership across threat detection, incident response, vulnerability management, identity security, security operations, and cybersecurity architecture, with clear ownership of key security platforms and enterprise programs.

Responsibilities

Lead cybersecurity incident detection, investigation, containment, remediation, and recovery activities.
Act as the primary technical resource during security incidents.
Develop and maintain incident response playbooks and procedures.
Partner with internal stakeholders, external partners, cyber insurance providers, and forensic teams during investigations.
Conduct threat hunting and root cause analysis activities.
Drive continuous improvements to security monitoring and alerting capabilities.
Own and enhance identity security controls across Microsoft Entra ID and Active Directory.
Lead implementation and management of Conditional Access, Multifactor Authentication (MFA), Privileged Identity Management (PIM), and FIDO2 passwordless authentication.
Secure endpoint environments through Microsoft Defender and Intune.
Establish identity governance and privileged access standards.
Partner with Digital and IT Teams to implement least-privilege access models.
Own Microsoft Defender XDR and related security technologies.
Monitor and investigate security events across endpoints, identities, email, cloud applications, and infrastructure.
Develop and maintain security dashboards, alerts, and operational reporting.
Improve security visibility through SIEM and security analytics capabilities.
Identify emerging threats and implement proactive mitigation strategies.
Lead the enterprise vulnerability management program, coordinating scanning, remediation, and risk prioritization.
Track and report security risks and remediation progress, coordinating remediation with technology teams.
Support third party penetration testing and security assessments.
Design and implement secure architecture across cloud, networking, infrastructure, and business applications.
Establish security standards, baselines, hardening guidelines, and operational controls.
Evaluate new technologies, vendors, and solutions from a cybersecurity perspective.
Translate evolving legal, regulatory, contractual, customer, cyber insurance, and industry compliance requirements into practical cybersecurity controls, policies, evidence, and remediation plans.
Lead cybersecurity support for audits and assessments, maintaining compliance evidence, identifying control gaps, and coordinating remediation.
Lead and mature disaster recovery and cyber resilience in partnership with infrastructure, application, business, and site leaders, including recovery strategies, standards, roles, runbooks, dependencies, and recovery requirements.
Plan, coordinate, and document recurring disaster recovery exercises, track findings, and drive corrective actions to completion.
Ensure recovery capabilities address cyberattack scenarios including ransomware, identity compromise, cloud service disruption, and loss of critical infrastructure.
Support security initiatives within Azure and Microsoft 365, including Microsoft Defender for Cloud and Secure Score improvements.
Collaborate with infrastructure teams to develop scalable and secure cloud architectures and support secure-by-design principles during cloud migration.
Develop and promote security awareness programs, including phishing simulations and user education activities.
Assist with cybersecurity due diligence for acquisitions and integrations.
Establish security metrics, KPIs, and executive-level reporting, and support ongoing cybersecurity maturity initiatives.
Work with vendors, managed service providers, consultants, and external partners, including managing deliverables, escalations, service performance, risks, and continuous improvement.
Coordinate vendor security reviews and provide contract and renewal input related to remediation commitments.

Requirements

5+ years of hands-on cybersecurity engineering experience in enterprise environments.
Experience with Microsoft security technologies including Microsoft Defender, Entra ID, Intune, Sentinel, and Microsoft 365 Security.
Experience leading or participating in cybersecurity incident response activities.
Experience implementing identity and access management controls.
Experience with vulnerability management programs and remediation processes.
Strong understanding of cybersecurity frameworks, risk management, and defense-in-depth principles.
Strong knowledge of network security, firewalls, endpoint protection, email security, and cloud security.
Experience with security monitoring and SIEM platforms.
Excellent problem-solving and analytical skills.
Strong communication and documentation abilities.
Ability to work independently and as part of a team.
Experience leading or materially improving disaster recovery, cyber resilience, or business continuity capabilities, including recovery planning and exercises.
Experience aligning cybersecurity controls and programs with evolving regulatory, contractual, customer, or industry compliance requirements.
Demonstrated experience managing security vendors and managed service providers, including deliverables, escalations, and service performance.

Technologies

Microsoft Defender, Entra ID, Intune, Sentinel, Microsoft 365 Security
Conditional Access, Multifactor Authentication (MFA), Privileged Identity Management (PIM), FIDO2
Microsoft Defender XDR
SIEM and security analytics
Microsoft Defender for Cloud, Secure Score
Azure, Microsoft 365, Active Directory
FIDO2 passwordless authentication

Preferred qualifications

CISSP, CISM, Security+, SC-200, SC-300, AZ-500, or equivalent security certifications.
Experience with Microsoft Sentinel and Defender XDR.
Experience securing Azure environments.
Experience with manufacturing or operational technology (OT) environments.
Experience supporting mergers and acquisitions due diligence and integrations.
Experience with penetration testing remediation and security assessments.
Experience with FIDO2, passwordless authentication, and Zero Trust initiatives.

Company values

Safety – everyone leaves Trystar facilities in the same or better condition than when they arrived.
Integrity – honest, transparent, and committed to doing what is right.
Customer focus – relentless focus on customers and their success.
Right with speed – good judgement, thoughtful decisions quickly, purposeful execution.
Play for each other – teamwork and showing up for one another.
Champion change – adaptation and improvement as requirements to survive and thrive.
Enjoy the journey – an environment where teams feel appreciated and have fun along the way.

View full job page →

Today

Senior Security Engineer

GORILLA GLUE COMPANY Sharonville, OH

Sharonville, OH

Today

Full time Senior Cloud Platforms Cloud Security

Apply Now

Job Description

The Senior Security Engineer is the primary technical cybersecurity expert for GORILLA GLUE COMPANY, helping design, implement, operate, and validate security controls across identity, endpoint, cloud, data protection, and security operations. This onsite role in Sharonville, OH focuses on reducing risk and continuously improving the company’s cybersecurity posture by partnering with internal teams and managed security providers.

In this position, you will support Microsoft security capabilities end to end, from identity and access to data protection and detection workflows, while also contributing to incident response, architecture reviews, and industrial cybersecurity for manufacturing and OT environments.

Key Responsibilities

Administer and continuously improve Microsoft Entra ID security controls, including Conditional Access, multifactor authentication, Privileged Identity Management, access reviews, and privileged-access hygiene.
Configure, operate, and optimize Microsoft Defender capabilities across endpoint, identity, email, cloud applications, and related security workloads.
Design and implement Microsoft Purview controls for data classification, data loss prevention, information protection, and secure AI adoption.
Maintain strong working knowledge of SIEM integrations, security telemetry, KQL, and Microsoft Sentinel to support the managed detection environment.
Design and implement security controls across Microsoft 365, Azure, hybrid identity, endpoints, servers, cloud services, and business technology environments.
Conduct security architecture reviews and technical risk assessments for new systems, projects, integrations, vendors, and cloud services.
Develop security automation using PowerShell, KQL, APIs, and orchestration capabilities to improve consistency, visibility, and response speed.
Establish technical standards, configuration baselines, implementation documentation, and operational runbooks for security controls.
Lead vulnerability and exposure prioritization using threat intelligence, exploitability, asset criticality, and business impact.
Partner with Infrastructure, application owners, and service providers to plan remediation, validate fixes, manage exceptions, and report aging and risk trends.
Validate deployment and coverage of required security agents, logging, integrations, and monitoring across in-scope assets.
Provide technical leadership during cybersecurity investigations and incidents, including scoping, containment, eradication, recovery, and lessons learned.
Coordinate with MDR/SOC providers on escalations, investigations, detection quality, telemetry gaps, and response actions.
Perform or support phishing investigations, identity investigations, endpoint analysis, cloud investigations, and data protection events.
Translate technical findings into clear remediation actions, risk statements, and status updates for security leadership and control owners.
Partner with Plant IT teams to strengthen cyber security posture of manufacturing and OT environments.
Assist in the design, implementation, and ongoing management of network segmentation and connected manufacturing technology.
Evaluate cybersecurity risks associated with industrial operations, control systems, and connected manufacturing technologies.
Ensure cyber security controls align with industry best practices, regulatory expectations, and corporate security standards.
Support Information Security policies, standards, and compliance requirements.
Maintain security documentation, diagrams, and procedures.
Assist with vendor security reviews and risk assessments.
Support audits and cybersecurity assessments.

What You Bring

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field (or equivalent professional experience).
5+ years of progressive experience in security engineering, cybersecurity operations, cloud security, identity security, or related disciplines.
Hands-on experience securing Microsoft 365, Azure, hybrid identity, endpoints, and cloud services.
Experience with vulnerability management, technical incident response, security monitoring, and remediation validation.
Practical experience with PowerShell, KQL, APIs, or other scripting and automation technologies.
Deep working knowledge of Microsoft Entra ID, Conditional Access, MFA, PIM, Microsoft Defender XDR, and Microsoft Purview.
Strong understanding of identity and access management, endpoint security, cloud security, data protection, logging, and zero trust concepts.
Ability to troubleshoot complex security issues, assess technical risk, and design practical controls for hybrid environments.
Ability to work effectively with Infrastructure, Service Desk, application owners, data teams, vendors, and managed security providers.
Strong analytical, documentation, communication, and project execution skills.

Technologies

Microsoft Entra ID
Conditional Access
Multifactor authentication
Privileged Identity Management
Microsoft Defender
Microsoft Purview
SIEM
KQL
Microsoft Sentinel
Microsoft 365
Azure
PowerShell
APIs
MDR/SOC providers
Microsoft Defender XDR
Zero trust

Benefits

Competitive compensation packages
Comprehensive healthcare benefits
Other perks and incentives
Recognized as a top place to work for 16 years in a row

Preferred Certifications

Microsoft Cybersecurity Architect Expert (SC-100) preferred
Microsoft Security Operations Analyst (SC-200), Identity and Access Administrator (SC-300), Information Protection and Compliance Administrator (SC-400), or Azure Security Engineer Associate (AZ-500) are beneficial
CISSP or equivalent security certification is helpful but not required

Company Values

Have fun, be passionate and show it!
Act with integrity and respect in all relationships.
Communicate openly and appreciate the effort of others.
Embrace knowledge, growth, and change.
Strive for excellence in what we do every day!

View full job page →

Security Siem Cybersecurity Jobs

Cybersecurity Analyst I

Cyber Security Engineer

Senior Security Engineer

Get Security Siem Cybersecurity Jobs alerts