Security Analyst, Soc (Tier 2)

Job Description
Insight Global is looking for a hands‑on Cyber Security Analyst to join a growing security team. This individual will play a key role in day‑to‑day security operations, incident response, MDR provider management, and the continued maturation of the organization's security program.The successful candidate will have a strong SOC / incident response background and hands‑on experience within the Microsoft security ecosystem, including Defender, Azure, Sentinel, Entra ID, and Intune. This person should be comfortable taking ownership of security incidents, working with an outsourced MDR provider, identifying gaps in monitoring and tooling, and helping move the security practice toward a more mature future state.This is not a governance‑focused role. The ideal candidate is technically curious, accountable, and capable of looking beyond individual tickets to identify opportunities to improve the overall security environment.Key Responsibilities
Incident Response & Security Operations
Own and manage the Tier 2 security incident queue, including triage, prioritization, investigation, containment, and closure.Manage approximately 5–7 day‑to‑day security tickets/incidents, while using additional capacity to improve SOC processes and security capabilities.Act as an escalation point for alerts generated by the MDR provider and internal service desk.Determine the validity and business impact of security incidents and escalated critical issues appropriately.Coordinate containment activities with IT and infrastructure teams, including account disabling, endpoint isolation and blocking.Maintain clear incident documentation, response playbooks and operational metrics.Identify gaps in monitoring, alerting and incident‑response processes and recommend improvements.MDR / MSSP Management
Act as the day‑to‑day technical contact for the organization's Managed Detection and Response (MDR) provider.Review and challenge MDR escalations to ensure alerts are actionable and meet agreed‑upon SLAs.Track MDR recommendations and incidents through resolution.Validate monitoring and tooling coverage across endpoints, network, cloud and applications.Help measure MDR performance and identify opportunities to mature the relationship and security practice.Microsoft Security & Cloud
Work hands‑on across the Microsoft security ecosystem, including:Microsoft Defender XDRMicrosoft SentinelMicrosoft Entra IDMicrosoft IntuneMicrosoft Purview / DLP Azure security toolingPerform security investigations, alert analysis and threat hunting.Review risky sign‑ins, device compliance, endpoint activity and cloud security events.Support Sentinel capabilities including data connectors, analytics rules, workbooks and KQL‑based investigations.Assist with the organization's continued consolidation and maturation of its Microsoft security environment.Application Security & DevSecOps
Partner with infrastructure and application‑development teams to ensure sufficient security monitoring exists across both infrastructure and application layers.Understand differences in security monitoring requirements across technologies such as Linux, .NET and WordPress applications.Review security requirements for Azure‑hosted workloads and web applications.Support secure software‑development practices such as code scanning, dependency scanning, secrets management and application logging.Help identify gaps in application‑layer monitoring and recommend appropriate controls and alerts.Contribute to incident‑response playbooks for threats including phishing, compromised accounts, ransomware precursors and web application attacks.We will use AI to search and screen candidates.Skills and Requirements
2–3+ years of hands‑on cybersecurity experience, ideally within a SOC, enterprise security operations or incident‑response environment.Demonstrated experience investigating and responding to security incidents from initial alert through resolution.Experience working with an outsourced MDR or MSSP and handling security alerts/escalations.Strong foundational knowledge of the Microsoft security stack, particularly: Microsoft Defender Microsoft Sentinel Azure Entra ID Intune.Understanding of SIEM technologies and security monitoring concepts.Familiarity with KQL or similar security‑query languages.Understanding of endpoint, network, cloud and application security events.Exposure to application security and/or DevSecOps concepts, particularly security logging and monitoring.Ability to identify gaps in security tooling, monitoring or processes and recommend improvements.Strong ownership and accountability with the ability to operate independently.Strong written and verbal communication skills with the ability to communicate incidents to both technical and non‑technical stakeholders.Microsoft SC-200 (Security Operations Analyst)Nice to HaveExperience working with Arctic Wolf or another MDR platform.Experience with Microsoft Sentinel configuration, connectors or analytics rules.Microsoft Purview / Data Loss Prevention experience.Application security experience with WordPress, .NET and/or Linux environments.Azure application and infrastructure security experience.Exposure to GitHub or Azure DevOps security tooling, including code scanning, dependency scanning and secrets management.Experience within manufacturing, distribution, logistics or another 24‑hour operational environment.CertificationsCertifications
Additional certifications considered an asset:Microsoft AZ-500Microsoft SC-100CompTIA Security+ or CySAGIAC GCIH / GCIAWe are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to View email address on ca.hrm.tc.
#J-18808-Ljbffr