SECURITY ANALYST

1. Monitor security platforms including SIEM, EDR, and cloud-native security tools for indicators of compromise,

indicators of attack, and incident response requirements.

2. Utilize Microsoft Defender XDR components (Endpoint, Cloud Apps, Identity, Office 365) extensively for

monitoring, analysis, and response.

3. Identify, triage, and investigate phishing incidents including those submitted manually by end-users.
4. Perform Identity and Access Management activities with a focus on identifying and managing risky users, risky

sign-ins, and sign-in event correlation.

5. Conduct in-depth investigations of security alerts, perform triage, and escalate or resolve incidents according to

established procedures.

6. Produce thorough documentation including after-action reports and lessons learned, aligned with incident

severity and organizational standards.

7. Adhere to strict threat-escalation policies based on incident classification, threat type, and statutory

requirements.

8. Support the full incident response lifecycle: detection, containment, eradication, recovery, and post-incident

reporting.

9. Maintain, tune, and optimize security detection rules, alerts, and automations to reduce false positives and

improve detection accuracy (with proper approvals).

10. Follow established change-management processes for all configuration or detection-control modifications.
11. Stay informed on emerging threats, evolving attack techniques, and advancements in security technologies.
12. Assist with development and implementation of security policies and procedures.
13. Prepare security documentation.
14. Develop risk analysis and security reporting.
15. Monitor and remediate software or hardware vulnerabilities.
16. Evaluate current and future security tools and systems.
17. Document hours worked by task(s).
18. Follow FWC IT processes and coordinate with other FWC IT staff to ensure compliance with FWC standards.
19. Complies with and enforces all agency policies, procedures, and security policies.
20. Provide Technical Training (Knowledge Transfer), as required for Office of Information Technology Support Staff as