Security Operation Analyst

Job Summary

Responsible for the day-to-day operation, administration,and hardening of the system's security tools and controls. Complements the SOCby owning security tooling health, vulnerability and patch remediation,configuration compliance, and audit readiness, so that security controls stayeffective, current, and evidenced.

Responsibilities

• Administer and maintain security platforms including Trend Micro (Vision One, Deep Security, Apex One), Tenable, Microsoft Sentinel, and DLP tools to ensure operational effectiveness
• Deploy and upgrade security agents, manage policies, and monitor tool health, licensing, and coverage for continuous protection
• Onboard new servers, applications, and log sources into security tooling and SIEM to expand monitoring scope
• Tune security policies, detection rules, and exclusions collaboratively with SOC and application teams to optimize threat detection
• Schedule and review vulnerability scans, validate and prioritize findings by CVSS, exploitability, and asset criticality to focus remediation efforts
• Raise remediation tickets, track progress to closure, and escalate overdue items to maintain timely vulnerability resolution
• Coordinate patch cycles with infrastructure and application teams, including emergency patching, to reduce exposure windows
• Manage risk acceptance and exception requests with supporting justification to balance security and business needs
• Apply and verify security baselines (e.g., CIS benchmarks for RHEL, Windows, and cloud) across servers and cloud workloads to enforce hardening
• Assess application impact of hardening controls with application teams before rollout to prevent disruptions
• Monitor configuration drift and track remediation of non-compliant assets to maintain compliance
• Support periodic access reviews, privileged account audits, and user access recertification to uphold identity security
• Review IAM roles and policies (e.g., AWS) against least-privilege principles to minimize access risks
• Monitor certificate expiry, key management, and secrets hygiene to ensure secure credential management
• Support SOC and incident response teams with investigation data, tool queries, and containment actions during incidents
• Contribute to post-incident reviews and implement control improvements to strengthen security posture
• Prepare regular reports on patch compliance, vulnerability trends, hardening status, and tool coverage for governance
• Collect and maintain evidence for audits and compliance checks (e.g., ISO 27001, government security standards) to demonstrate control effectiveness
• Maintain security SOPs, runbooks, and the security risk register to support operational consistency
• Track security-related change requests and participate in change advisory discussions to manage risk during changes

Required competencies and certifications

• Diploma or Bachelor's degree in Cybersecurity, IT, ComputerScience, or a related field (or equivalent experience)
• 3-5 years in security operations, security administration,or infrastructure security
• Hands-on experience administering endpoint, XDR, orvulnerability management tools (Trend Micro and Tenable preferred)
• Experience with patch management and configuration hardeningon Linux (RHEL preferred) and Windows
• Working knowledge of AWS security services and sharedresponsibility model
• Preferred certifications: CompTIA Security+, CISSP(associate or full), Microsoft SC-200, AWS Security Specialty
• Nice to have: CISM, CISA, ISO 27001 Lead Implementer,Tenable certifications

Skills

• Strong understanding of security frameworks and standards(CIS, NIST, ISO 27001, MITRE ATT&CK)
• Familiarity with SIEM, EDR/XDR, DLP, WAF, firewalls, andvulnerability scanners
• Scripting and automation (Bash, PowerShell, Python, Ansible)for compliance checks and reporting
• Working knowledge of ITSM tools (e.g. ServiceNow) and changemanagement processes
• Strong analytical and documentation skills, with the abilityto explain risk to technical and non-technical stakeholders
• Ability to drive remediation across multiple teams andvendors