[Hiring] Security Analyst - Project Lead @ICAP Solutions

Role Description

Position is Remote within the United States. Preference will be given to a candidate who can work onsite over hybrid and over full-time remote (on-site as needed).

• Interview Process: 1 Round of Virtual/Online Interviews - potential for second round of in-person interviews
• Duration of the Contract: 12 Months
• Possibility for Extension: Yes
• Work Location: Remote
• Candidate location: No South Carolina residency required. Open to nationwide candidates; must be able to work eastern time zone hours. All travel-related costs for onsite work will be the responsibility of the resource, regardless of the frequency of onsite work.
• Preference will be given to candidates that are local to SC and are able to come onsite for project needs.
• Pre-employment Checks: DRUG, DRIVING, CREDIT, CRIMINAL, E-VERIFY, SLED

Daily Duties / Responsibilities:

• Continuously review and correlate security event data across SIEM, EDR, IDS/IPS, and threat intelligence sources to identify complex attack patterns, emerging threats, and security incidents.
• Perform deep-dive analysis of suspicious activity, validate incidents, determine root cause and impact, and escalate critical incidents with detailed context to Tier 3 as required.
• Create detailed incident reports, timelines, and post-incident summaries; contribute to lessons-learned documentation and recommendations for remediation and preventative measures.
• Investigate user-reported phishing, malware infections, and potential policy violations; advise users and internal/external teams on containment and recovery actions.
• Recommend updates to SOC playbooks and workflows based on real-world investigations, fine-tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve threat coverage.
• Collaborate with engineering teams to ensure monitoring tools are properly configured and tuned. Integrate new threat intelligence feeds into workflows and proactively hunt for threats using up-to-date tactics, techniques, and procedures (TTPs).
• Serve as a customer-facing SME, “selling” the value of DIS services by demonstrating capabilities and resolving issues.
• Document processes, runbooks, and troubleshooting steps related to SOC operations.
• Coordinate with engineering, SOC, and agency staff as needed to meet goals.
• Other duties as needed.

Qualifications

• 2+ Years of Experience with Security Monitoring and Incident Response.
• 2+ Years of Experience with MITRE ATT&CK framework.
• 2+ Years of Experience with dashboard creation and reporting.

Requirements

• Experience with the Palo Alto Cortex XSIAM/XDR platform.
• Knowledge of Linux, network administration and network design.
• Experience in administration of firewalls, VPN technology, Active Directory, Intrusion Detection/Prevention systems.
• Candidate is local to Columbia, SC or surrounding city in South Carolina.

Required Education/Certifications

• Associate’s degree in an information technology or information security related field.
• Four years of relevant work experience may be substituted in lieu of education.
• Two years of experience in supporting large SOC operations.

Preferred Education/Certifications

• CISSP, CISA, CISO or equivalent advanced security certification.
• Additional relevant certifications (e.g., CEH, OSCP, GPEN).
• Vendor certifications related to information security.

Interview Process

• Initial round of interviews on Microsoft Teams (on camera) with in-person interviews preferred before final selection.