CyberSecurity Analyst

Our Client, A century old law firm with a strong M&A Reputation is looking to hire a SoC Analyst in Minneapolis, Minnesota. This is a contract role with no end date.

The SoC Analyst performs security investigations with limited supervision, supports security monitoring and data-protection capabilities, and contributes technical knowledge across cybersecurity operations. The Cybersecurity Analyst supports Microsoft Sentinel, Microsoft Purview, Data Loss Prevention, security assessments, and security governance activities. The role assists with developing and tuning detections, supports response automation and incident-response activities, evaluates control effectiveness using established procedures, maintains governance and compliance evidence, and communicates findings and remediation recommendations to technical and business stakeholders. Complex or high-impact matters are escalated to senior staff or management.

RESPONSIBILITIES

• Understand the core business activities and support information security solutions that protect those activities.
• Perform triage and investigation of security events involving identity, endpoints, email, cloud services, applications, and network activity.
• Support containment, eradication, recovery, evidence preservation, and post-incident follow-up for security incidents; escalate complex or material risks to senior staff or management.
• Monitor and support Microsoft Sentinel operations, including data connectors, analytics rules, automation rules, workbooks, watchlists, incident workflows, and monitoring-health processes.
• Create and modify KQL queries for alert investigation, reporting, and basic threat hunting.
• Assist with developing and tuning detections to improve fidelity, reducing false positives, address monitoring gaps, and align coverage with relevant threats and the MITRE ATT&CK framework.
• Participate in investigations and escalations with managed security service providers, technology teams, legal, privacy, compliance, and business stakeholders.
• Support defined Microsoft Purview capabilities, including Information Protection, sensitivity labels, audit, eDiscovery, Insider Risk Management, and related security investigations.
• Assist with testing, tuning, and reviewing Data Loss Prevention policies across Microsoft 365 services and supported endpoints.
• Investigate DLP alerts, document findings, and coordinate exception requests and remediation with data owners and appropriate stakeholders; escalate policy and risk decisions as needed.
• Assist with security assessments of technology platforms, applications, vendors, configurations, and operational processes using established standards and procedures; document findings and contribute to remediation recommendations.
• Support security governance and compliance activities by maintaining control evidence, procedures, metrics, risk documentation, and remediation records.
• Develop and maintain incident runbooks, investigation procedures, detection documentation, and assessment findings; contribute to architecture diagrams, operational standards, and executive summaries with senior-team guidance.
• Communicate technical findings in terms of business impact, risk, remediation options, and operational priority.
• Participate in peer reviews and share knowledge with team members.
• Participate in an after-hours on-call rotation and support escalation activities for significant security incidents.
• Perform other related cybersecurity operations duties as assigned.

REQUIREMENTS

• Demonstrated experience investigating and responding to cybersecurity events with limited supervision.
• Working knowledge of the incident-response lifecycle, including identification, containment, eradication, recovery, evidence handling, and post-incident review.
• Hands-on experience using a SIEM; Microsoft Sentinel experience preferred, including familiarity with KQL, analytics rules, workbooks, automation, data connectors, and threat hunting.
• Experience with Microsoft Purview Information Protection, Data Loss Prevention, audit, eDiscovery, or related compliance capabilities.
• Ability to investigate potential data-loss events and document findings while considering security, legal, privacy, compliance, and business requirements.
• Experience supporting security-control reviews, identifying gaps, documenting risk, and contributing to practical remediation recommendations.
• Familiarity with security and compliance frameworks such as NIST CSF, NIST 800-53, CIS Controls, ISO 27001, or comparable frameworks.
• Experience with security technologies such as EDR, identity protection, email security, CASB, IDS/IPS, web proxies, DNS security, sandboxing, and firewalls.
• Ability to correlate data from multiple security systems and distinguish normal activity from potentially malicious behavior.
• Strong technical writing skills, including the ability to produce procedures, investigation reports, risk statements, and control evidence.
• Ability to communicate clearly with engineers, business owners, management, legal, privacy, compliance, and external providers.
• Ability to prioritize assigned investigations and tasks in coordination with the team in a high-pressure environment.
• Ability to participate constructively in peer reviews and knowledge sharing.
• Two or more years of relevant experience in cybersecurity operations, incident response, detection engineering, data protection, governance, or related disciplines; three to five years preferred.
• Demonstrated experience with SIEM platforms; hands-on Microsoft Sentinel and KQL experience preferred.
• Experience with Microsoft Purview, Data Loss Prevention, information protection, or comparable data-security technologies.
• Experience assisting with security assessments and documenting control gaps, risks, and remediation recommendations.
• Strong analytical, problem-solving, documentation, and stakeholder-communication skills.
• Ability to independently handle routine and moderately complex investigations or assigned technical work, with escalation of high-risk or highly complex matters.
• Willingness to share knowledge and contribute to team processes and continuous improvement.