Note: The job is a remote job and is open to candidates in USA. Foresite Cybersecurity is a mission-driven partner helping organizations navigate an increasingly complex threat landscape. They are seeking a Security Analyst II to work in their Security Operations Center, handling escalated security alerts and leading investigations for managed customers while mentoring junior analysts.
Responsibilities
- Act as an escalation point: Serve as the primary point of escalation for our Tier 1 Analysts. You will handle complex event triage escalations, guide junior analysts through difficult dispositions, and provide decisive action on high-severity alerts
- Be a point of information and mentorship: Act as a knowledge resource for the Analyst 1 team. Answer questions regarding investigations, customer environments, and tool navigation to help upskill the shift
- Investigate incidents end-to-end: Review complex alert context, gather evidence from Chronicle UDM and supporting tools, reach a final disposition, and either close the ticket with a documented rationale or escalate to Tier 3/Incident Response with a clear handoff
- Optimize investigation playbooks: Follow established playbooks for the detection stack, but actively identify gaps, propose workflow improvements, and help draft new guidance alongside your Team Lead to improve overall SOC efficiency
- Communicate clearly in tickets: Every ticket you touch should be understandable by the next analyst, the customer, or an auditor reading it six months from now. Your written analysis is the primary artifact of your work and should set the standard for Tier 1 analysts
- Partner with customers: Lead communications through the ticketing system on routine and complex investigations, requests for information, and exclusion/suppression requests
- Meet SLA and quality targets: Consistently meet performance scorecards for time-to-resolve, triage accuracy, and ticket closure quality, setting a benchmark for the shift
- Contribute to detection fidelity: Actively hunt for noisy rules, false-positive patterns, and alert clusters. Submit highly detailed tuning requests and recommendations to the detection engineering team
- Participate in shift handoff: Brief the incoming shift on open investigations, anomalies observed, and escalated items waiting on customer response
Skills
- 2–4 years of prior experience in a SOC, incident response, or dedicated cybersecurity role
- Advanced knowledge of core security concepts: Deep understanding of the cyber kill chain and MITRE ATT&CK framework, common attack vectors (phishing, credential abuse, malware delivery, lateral movement), and hands-on experience with detection, prevention, and response tactics
- Proficiency with a SIEM: You have hands-on experience navigating SIEM platforms. You understand how alerts are generated, how to build advanced search queries, and how to pivot seamlessly from an alert to supporting log evidence to build a timeline of events
- Strong written communication: You will be writing in tickets that customers read. Clear, concise, accurate writing is non-negotiable
- Attention to detail: False positives and true positives often look nearly identical. You are the analyst who reads the full log line, not the summary, and you teach others to do the same
- Ability to work Monday - Friday, 5pm - 1am CT
- CompTIA Sec+, CompTIA CySA+, BTL1, or equivalent certification is required within 90 days of hire if not already held
- Hands-on experience with Google Security Operations (Chronicle), Splunk, Elastic, or Microsoft Sentinel
- BS of IT Security or Cyber Security
- Familiarity with endpoint detection and response tools (CrowdStrike, SentinelOne, Defender for Endpoint, Carbon Black)
- Intermediate scripting or query experience (Python, PowerShell, SQL, or YARA-L/SIEM query languages) to assist with automation or custom searches
- Prior MSSP or multi-tenant environment experience
- Additional advanced certifications: GCIA, GCIH, Google Cloud Security Engineer, or similar
Benefits
- Comprehensive Health & Wellness: Robust medical insurance options to keep you and your family healthy.
- Employer-Covered Insurance: We fully provide employer-paid Dental coverage, as well as Short-Term (STD) and Long-Term Disability (LTD).
- Recharge & Refuel: We believe in a true work-life balance. You’ll start with 3 weeks of paid vacation, plus additional sick leave and paid company holidays to ensure you have time to recharge.
- Growth & Mentorship: Access to world-class training and mentorship. We support your career trajectory, whether you’re looking to deepen your technical skills or move into leadership.
Company Overview
Company H1B Sponsorship