Security Analyst I

ABC Legal Services is adding a Security Analyst I to its IT team. This is an early career role for someone who already has security work under their belt and wants to own more of it.

You will work directly with the IT Manager and the System Administrator team on the day to day security operations that keep the company safe: alert triage, access reviews, endpoint compliance, vulnerability remediation, and audit evidence. You will not be expected to arrive knowing our environment. You will be expected to already know how to work an alert.

We are a small team, so you will see the whole picture rather than one narrow slice of it.

Security operations (your core work) Triage detections in CrowdStrike Falcon, escalating what needs a second set of eyes Work in the Falcon console daily: detections, host containment, policy and sensor health, and detection tuning as you ramp Review Entra ID sign in and audit logs for suspicious authentication activity Investigate user reported phishing and take action on malicious mail Work the vulnerability queue: track findings, chase remediation, report on progress Run recurring access reviews across Microsoft Entra ID and flag anything that looks wrong Identity and endpoint support Partner with the System Administrator team on Conditional Access and MFA policy Monitor device compliance and encryption status in Intune (Windows) and Iru (macOS) Help remediate configuration and patch drift across the fleet Compliance and documentation Collect and organize evidence for audits and client security requirements Help complete security questionnaires Document procedures in Confluence and track your work in Jira User security Help run phishing simulations and security awareness training Be an approachable point of contact when someone is not sure whether something is safe What you bring 2 or more years in IT, including at least 1 year of hands on security work. That security year can be a dedicated security role or security responsibilities carried inside a broader IT job Direct experience with an EDR platform. CrowdStrike Falcon preferred, and experience with Defender for Endpoint, SentinelOne, or similar transfers Practical experience triaging security alerts and working an investigation to a conclusion Working familiarity with Microsoft 365 and Entra ID administration Careful, methodical habits. Security work rewards people who check twice Clear writing, and the patience to explain a risk to someone who does not work in IT Nice to have CompTIA Security+, SC-200, AZ-500, or a CrowdStrike certification, or active progress toward one Any PowerShell scripting macOS management exposure (Iru, Kandji, or Jamf) Familiarity with SOC 2, NIST CSF, or CIS Controls Experience in legal, financial, or another regulated industry

Triage detections in CrowdStrike Falcon, escalating what needs a second set of eyes

Work in the Falcon console daily: detections, host containment, policy and sensor health, and detection tuning as you ramp

Review Entra ID sign in and audit logs for suspicious authentication activity

Investigate user reported phishing and take action on malicious mail

Work the vulnerability queue: track findings, chase remediation, report on progress

Run recurring access reviews across Microsoft Entra ID and flag anything that looks wrong

Partner with the System Administrator team on Conditional Access and MFA policy

Monitor device compliance and encryption status in Intune (Windows) and Iru (macOS)

Help remediate configuration and patch drift across the fleet

Collect and organize evidence for audits and client security requirements

Help complete security questionnaires

Document procedures in Confluence and track your work in Jira

Help run phishing simulations and security awareness training

Be an approachable point of contact when someone is not sure whether something is safe

2 or more years in IT, including at least 1 year of hands on security work. That security year can be a dedicated security role or security responsibilities carried inside a broader IT job

Direct experience with an EDR platform. CrowdStrike Falcon preferred, and experience with Defender for Endpoint, SentinelOne, or similar transfers

Practical experience triaging security alerts and working an investigation to a conclusion

Working familiarity with Microsoft 365 and Entra ID administration

Careful, methodical habits. Security work rewards people who check twice

Clear writing, and the patience to explain a risk to someone who does not work in IT

CompTIA Security+, SC-200, AZ-500, or a CrowdStrike certification, or active progress toward one

Any PowerShell scripting

macOS management exposure (Iru, Kandji, or Jamf)

Familiarity with SOC 2, NIST CSF, or CIS Controls

Experience in legal, financial, or another regulated industry

We know that a company's success starts with its employees. We also know that an individual's success starts with the right career opportunity. Join our team today!

Health, Dental, Vision insurance

401(k) with company matching

Paid time off

7 Paid company holidays

4 Floating holidays per-year

Life Insurance and AD&D Insurance

Long Term Disability

Health Care Reimbursement Flexible Spending Account

Dependent Care Flexible Spending Account

EAP (Employee Assistance Program)

Pet Insurance