SECURITY OPERATIONS ANALYST

Own the day-to-day operation, administration, and hardening of the organization’s security tools and controls. Partner with the SOC by ensuring security tooling health, managing vulnerability and patch remediation, overseeing configuration compliance, and maintaining audit readiness—so security controls remain effective, up to date, and fully evidenced.

Key Responsibilities:

Security Tooling Administration

Administer and maintain security platforms including Trend Micro (Vision One, Deep Security, Apex One), Tenable, Microsoft Sentinel, and DLP tools

Deploy and upgrade agents, manage policies, and monitor tool health, licensing, and coverage

Onboard new servers, applications, and log sources into security tooling and SIEM

Tune policies, detection rules, and exclusions in coordination with the SOC and application teams

Vulnerability & Patch Operations

Schedule and review vulnerability scans, and validate and prioritize findings using CVSS, exploitability, and asset criticality

Create remediation tickets, track them through closure, and escalate overdue items

Coordinate patch cycles with infrastructure and application teams, including emergency patching

Manage risk acceptance and exception requests, supported by clear justification

Hardening & Configuration Compliance

Apply and verify security baselines (e.g. CIS benchmarks for RHEL, Windows, and cloud) across servers and cloud workloads

Evaluate the application impact of hardening controls with application teams prior to rollout

Monitor configuration drift and ensure remediation of non-compliant assets is completed

Access & Identity Security

Support periodic access reviews, privileged account audits, and user access recertification

Review IAM roles and policies (e.g. AWS) against least-privilege principles

Monitor certificate expiry, key management, and maintain secret hygiene

Incident Support

Support the SOC and incident response team by providing investigation data, tool queries, and assistance with containment actions

Participate in post-incident reviews and implement resulting control improvements

Governance, Reporting & Audit

Produce regular reports covering patch compliance, vulnerability trends, hardening status, and tool coverage

Collect and maintain evidence for audits and compliance checks (e.g. ISO 27001, government security standards)

Maintain security SOPs, runbooks, and the security risk register

Track security-related change requests and participate in change advisory discussions

Qualifications:

Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience)

3-5 years of experience in security operations, security administration, or infrastructure security

Hands-on experience administering endpoint, XDR, or vulnerability management tools (Trend Micro and Tenable preferred)

Experience with patch management and configuration hardening on Linux (RHEL preferred) and Windows

Working knowledge of AWS security services and the shared responsibility model

Preferred certifications: CompTIA Security+, CISSP (associate or full), Microsoft SC-200, AWS Security Specialty

Nice to have: CISM, CISA, ISO 27001 Lead Implementer, Tenable certifications

Skills:

Strong understanding of security frameworks and standards (CIS, NIST, ISO 27001, MITRE ATT&CK)

Familiarity with SIEM, EDR/XDR, DLP, WAF, firewalls, and vulnerability scanners

Scripting and automation (Bash, PowerShell, Python, Ansible) for compliance checks and reporting

Working knowledge of ITSM tools (e.g. ServiceNow) and change management processes

Strong analytical and documentation skills, with the ability to communicate risk to both technical and non-technical stakeholders

Ability to drive remediation across multiple teams and vendors