What You’ll Do

Vulnerability and Exposure Management

• Run Rapid7 InsightVM scans, maintain asset coverage and scan schedules, and keep credentialed scanning healthy.
• Prioritize findings by risk and exploitability, track remediation with IT owners, and report on SLA performance.
• Validate patches and configuration fixes, and manage exceptions through our documented risk-acceptance process.

Alert Triage and Response

• Work alerts from Rapid7 InsightIDR, SentinelOne, and Microsoft Defender, and coordinate with our 24x7 SOC on escalations.
• Flag noisy or low-value detections to the engineering team so they can be tuned.
• Support incident response by handling initial triage and containment steps per our playbooks, documenting findings, and contributing to post-incident reviews.

Endpoint Security

• Handle day-to-day SentinelOne console work: policies, exclusions, device groups, and agent health.
• Investigate threats using SentinelOne Deep Visibility and Storyline data, and perform remediation and rollback when needed.
• Work with the engineering team and Intune and Defender administrators to avoid policy gaps and conflicts.

Email Security

• Handle daily Barracuda Email Protection work: quarantine management, allow and block lists, and impersonation and phishing alerts.
• Investigate reported phishing and suspicious messages, and remove malicious email from affected mailboxes.
• Pass false positive and tuning findings to the engineering team, and support security awareness efforts with phishing trends and simulation results.

Microsoft Environment

• Review Entra ID, Active Directory, and Microsoft 365 security findings, including Secure Score and CIS benchmark gaps, and apply approved changes.
• Monitor DLP and sensitivity label alerts and handle policy match reviews.
• Partner with the infrastructure team on remediation items.

Documentation and Reporting

• Write and maintain runbooks, incident playbooks, and procedures.
• Collect evidence and support audit and compliance requests.
• Produce clear metrics and status reports for IT leadership.
• Participate in an on-call rotation for security incidents.

What You Bring

• 2 to 4 years of hands-on experience in security operations, security analysis, or a closely related IT security role.
• Experience with Rapid7 (InsightVM and/or InsightIDR) or a comparable vulnerability management or SIEM platform.
• Hands-on experience with SentinelOne or another enterprise EDR such as CrowdStrike or Defender for Endpoint.
• Experience with Barracuda or another email security gateway such as Proofpoint, Mimecast, or Check Point, and a working understanding of SPF, DKIM, and DMARC.
• Working knowledge of the Microsoft ecosystem: Active Directory, Entra ID, Microsoft 365, Intune, and Windows Server.
• Working knowledge of networking (TCP/IP, DNS, firewalls, VPN) and common attack techniques, including MITRE ATT&CK.
• Experience investigating incidents and documenting findings clearly for technical and non-technical audiences.
• Basic PowerShell scripting ability, or a willingness to learn.
• Bachelor’s degree in cybersecurity, computer science, IT, or a related field, or equivalent experience.

Nice to Have

• Familiarity with NERC CIP or other critical infrastructure compliance requirements.
• Exposure to OT/ICS environments.
• Experience with Microsoft Sentinel, KQL, or SOAR automation.
• Knowledge of NIST CSF, NIST 800-53, or CIS Controls.
• Interest in AI security and governance, including securing enterprise AI tools and managing unsanctioned AI apps.
• Certifications such as Security+, CySA+, GCIH, GSEC, SC-200, AZ-500, or CISSP (or progress toward one).