Network Cloud Security Analyst (SIEM, Splunk)

Title: Network Cloud Security Analyst (SIEM, Splunk)

Duration: 6+ Months

Location: Austin, TX 78741. Teleworking is currently allowed for this contract position with management approval. The working position is Hybrid - On Site and Telework.

Summary:

The Network Security Analyst is responsible for proactively identifying, investigating, and disrupting advanced cyber threats that evade traditional security controls. The role focuses on hypothesis-driven analysis, adversary behavior detection, and continuous improvement of threat detection capabilities.

Key Responsibilities

• Proactively conduct threat hunting activities to identify malicious activity, advanced persistent threats, and indicators of compromise not detected by automated tools
• Develop and execute hypothesis-driven hunts based on threat intelligence, adversary tactics, techniques, and procedures (TTPs), and organizational risk profiles
• Analyze endpoint, network, identity, and cloud telemetry to detect anomalous or suspicious behavior
• Investigate and validate potential security incidents, determine root cause, and assess scope and impact
• Collaborate with incident response, SOC, and detection engineering teams to support containment, eradication, and recovery activities
• Translate threat hunting findings into actionable detection logic, alerts, and analytics to improve security monitoring
• Document hunting methodologies, findings, and recommendations in formal reports and knowledge repositories
• Contribute to the development and tuning of security use cases, queries, and detection rules across SIEM, EDR, NDR, and cloud security platforms
• Leverage threat intelligence sources to track emerging threats, attacker tools, and campaigns relevant to the organization
• Support purple team activities, tabletop exercises, and continuous adversary simulation efforts
• Maintain awareness of evolving attacker techniques and emerging cybersecurity threats.
• The above job description and requirements are general in nature and may be subject to change based on the specific needs and requirements of the organization and project.

Required Skills:

• 8 years of Required Strong understanding of attacker tactics, techniques, and procedures.
• 8 years of Required Experience analyzing logs and telemetry from SIEM, EDR/XDR, network security, identity platforms, and cloud environments.
• 8 years of Required Proficiency in query languages and scripting used for threat hunting.
• 8 years of Required Solid knowledge of Windows, Linux, and cloud operating systems, including common attack vectors and persistence mechanisms.
• 8 years of Required Proven expertise in security considerations of cloud computing: They include data breaches, broken authentication, hacking, account hijacking, malicious insiders, third parties, APTs, data loss and DoS attacks.
• 8 years of Required Knowledge and understanding of threat analysis and assessment of potential and current information security risk/threats and designing solutions to mitigate those threats.
• 8 years of Required Knowledge and experience working with relevant National Institute of Standards and Technology (NIST) standards.
• 8 years of Required Familiarity with threat intelligence sources, malware analysis concepts, and digital forensics fundamentals.
• 8 years of Required Experience documenting investigations, creating hunt reports, and communicating technical findings to diverse audiences.
• 8 years of Required Strong analytical, problem-solving, and critical-thinking skills.
• 8 years of Required Ability to work independently while collaborating effectively within cross-functional cybersecurity teams.
• 8 years of Required Ability to resolve complex security issues in diverse and decentralized environments; to learn, communicate, and teach new information and security technologies; and to communicate effectively.
• 8 years of Required Conduct forensic investigations on cyberattacks to determine how they occurred and how they can be prevented in the future.
• 8 years of Required Experience creating/reviewing/updating security policies and standards for the public/private/hybrid cloud contexts.

Preferred Skills:

• 3 years of Preferred GSEC, CEH, CISA, CCSP
• 3 years of Preferred Certification as an AWS Solutions Architect, Cloud Security Certification, and/or OpenStack Administrator Certification a plus. (Other cloud-related certification also a plus.)
• 3 years of Preferred Experience with Endpoint Detection and Response (i.e. EndGame, Crowdstrike, CyberReason). Detect and respond to alerts from end point detection response tools.
• 3 years of Preferred Experience with Email Threat Management (i.e. Proofpoint, MimeCast, Microsoft).
• 3 years of Preferred Experience with SIEM engineering design/management/analysts (i.e. years of Splunk, Rapid7, SumoLogic).
• 3 years of Preferred Experience with Data Loss Protection/Cloud Access Security Brokers (i.e. Symantec, Microsoft, Bitglass, Netskope).
• 3 years of Preferred Experience with Cloud Enterprise Network Security (i.e. Cisco Umbrella, Palo Alto, ZScaler).