Security & Network Analyst II

Security & Network Analyst II

Under intermediate supervision, the Security & Network Analyst II supports cybersecurity operations by monitoring security events, identifying potential threats, and assisting with incident response activities. This role supports threat detection and incident response efforts, collaborates with security engineers and analysts to improve security controls, and contributes to threat hunting and detection tuning initiatives. The Security Analyst II applies developing expertise to identify risks, strengthen defenses, and enhance the organization's overall security posture.

Key Responsibilities & Essential Functions

Support security and network operations activities with a focus on threat detection, cyber defense, incident response, and maintaining the security and availability of enterprise systems.

Monitor, investigate, and resolve alerts from SIEM, EDR/XDR, IDS/IPS, firewall, vulnerability management, identity, cloud security, and network monitoring platforms.

Analyze logs, endpoint telemetry, authentication records, firewall events, DNS activity, proxy logs, packet captures, and network flow data to identify security threats, operational issues, and performance concerns.

Investigate and manage assigned tickets, including suspicious activity reports, security alerts, vulnerability findings, VPN issues, access requests, connectivity problems, and service interruptions.

Conduct incident response activities, including event analysis, scoping, evidence collection, documentation, containment support, escalation, and post-incident follow-up in accordance with established procedures.

Troubleshoot issues involving DNS, DHCP, routing, switching, firewall policies, VPN connectivity, wireless networks, identity services, endpoints, and application access.

Evaluate false positives, benign activity, policy violations, operational issues, and security incidents requiring escalation or response.

Escalate complex technical issues to Security Engineering, Network Engineering, Infrastructure, or application support teams with appropriate documentation, supporting evidence, and impact assessments.

Assist with identifying recurring issues, monitoring gaps, alert quality concerns, and process improvement opportunities; recommend enhancements to strengthen operational effectiveness and security visibility.

Support vulnerability management activities by validating findings, assessing exposure, assisting with remediation prioritization, and tracking resolution efforts.

Assist with firewall rule reviews, VPN troubleshooting, network segmentation validation, access control issues, implementation testing, and post-change monitoring with minimal oversight.

Collaborate with Security Engineering, Network Engineering, Infrastructure, and application teams to improve security monitoring, detection capabilities, operational procedures, and incident response processes.

Create and maintain investigation notes, knowledge base articles, troubleshooting guides, operational procedures, and incident documentation with minimal oversight.

Provide guidance and knowledge sharing to less experienced analysts and contribute to team training initiatives when needed.

Participate in security projects, technology implementations, and continuous improvement efforts to enhance cybersecurity and network operations capabilities.

Perform other duties as assigned.

Knowledge, Skills, and Abilities

Bachelor's degree required; Master's degree preferred. A combination of education and experience will be considered in lieu of a degree.

Three or more years of experience in technology, cybersecurity operations, network operations, infrastructure support, incident response, or a closely related technical role.

Intermediate knowledge related to SOC, NOC, security operations, network operations, managed security, enterprise infrastructure, or hybrid security/network operations environment preferred.

Demonstrated ability to work independently on complex tickets, alerts, incidents, and troubleshooting tasks with limited supervision and strong judgment on when to escalate.

Intermediate Knowledge of TCP/IP, DNS, DHCP, routing, switching, VPNs, firewalls, proxy services, wireless networking, endpoint security, identity and access management, and common enterprise security controls.

Intermediate experience using several of the following tools preferred: SIEM (e.g., Splunk), EDR/XDR (e.g., Microsoft Defender, Cortex XDR), firewall management platforms (e.g., Palo Alto Panorama/PA firewalls, Cisco firewalls), vulnerability scanners (e.g., Tenable), email/phishing security tools (e.g., PhishER), IDS/IPS, packet capture tools, network monitoring systems, log analysis platforms, ITSM/ticketing systems, and cloud security or infrastructure monitoring tools.

Experience to analyze endpoint, identity, network, cloud, and application telemetry to identify anomalous activity, unauthorized access, malware behavior, phishing, credential abuse, lateral movement, vulnerability exploitation, or service degradation.

Ability to perform structured troubleshooting and root-cause analysis across security, network, endpoint, identity, and application layers.

Experience supporting incident response activities such as alert validation, event correlation, impact assessment, containment coordination, evidence collection, timeline development, and post-incident documentation.

Experience reviewing or supporting firewall policies, VPN access, network segmentation, remote access technologies, and secure connectivity workflows preferred.

Understanding of frameworks and models such as NIST NICE, NIST Cybersecurity Framework, NIST SP 800-53, CIS Controls, MITRE ATT&CK, or similar operational security frameworks preferred.

Experience supporting hybrid cloud or SaaS environments such as AWS, Azure, Google Cloud, Microsoft 365, Okta, Entra ID, or similar platforms preferred.

Experience with scripting, automation, or query languages such as PowerShell, Python, Bash, KQL, SPL, SQL, SOAR playbooks, or API-based workflows preferred.

Security, network, or cyber defense certification(s) preferred, such as Security+, Network+, CySA+, SSCP, GSEC, CCNA, or equivalent experience.

A track record of taking initiative, being resourceful, and consistently improving alert quality, documentation, troubleshooting processes, and operational outcomes.

Effective organizational skills and ability to manage competing priorities in a high-volume ticket and alert environment.

Ability to establish and maintain productive relationships with internal customers, engineers, vendors, leadership, and cross-functional technology teams.

Career ladder readiness - demonstrated interest and capability to progress into a Security & Network Analyst II role by developing implementation, automation, design validation, and technical ownership skills.

Delivery - delivery skills including the ability to manage tickets and investigations at a steady, predictable pace; document work clearly; identify important tradeoffs; and complete operational work while contributing to durable process improvements.

Domain Expertise - Experience demonstrating domain expertise including the ability to understand immediate systems, recognize relationships with adjacent systems, stay aware of security and network trends, and apply technical knowledge to business priorities.

Problem Solving - A problem solver who breaks small or ambiguous issues into manageable investigative steps, recognizes mistakes as learning opportunities, and recommends solutions that reduce recurrence and improve long-term reliability.

Communication - Strong communicator who can articulate technical findings clearly and concisely, collaborate as both mentor and mentee, ask clarifying questions when requirements are vague, provide appropriate feedback, receive constructive criticism, and ma