IT Security Analyst

The Entry-Level IT Security Analyst provides first-line review and analysis of alerts generated by Wazuh, Bitdefender, and other approved security or IT management tools. The analyst validates alert context, reviews relevant logs, inspects affected computers or devices, gathers evidence, follows approved response procedures, and records findings in the designated ticketing or incident-management system.

This role works under the direction of the IT Security Manager or assigned senior security resource. The analyst is expected to use sound basic IT and security knowledge, remain within approved access and response boundaries, escalate uncertainty promptly, protect confidential information, and avoid making unsupported conclusions or high-risk production changes without authorization.

Requirements

• Alert Queue Monitoring: Review assigned security alerts and notifications consistently, acknowledge them promptly, and prevent unresolved events from aging without ownership.
• Initial Incident Analysis: Gather relevant facts from Wazuh, Bitdefender, operating-system logs, ticket history, asset records, and approved supporting tools before forming an assessment.
• Affected Equipment Inspection: Perform structured remote or physical inspection of affected endpoints and related equipment using approved checklists, access methods, and safety precautions.
• Evidence Collection and Preservation: Capture sufficient evidence to support escalation, investigation, remediation, audit, and possible root-cause review while protecting integrity and confidentiality.
• Incident Classification and Escalation: Apply the approved severity matrix and escalate suspected malware, unauthorized access, data exposure, policy violations, repeated detections, or uncertain findings to the designated incident lead.
• Authorized Containment Support: Carry out only approved containment actions and immediately report any business interruption, tool failure, unexpected behavior, or unsuccessful response action.
• Remediation Verification: Confirm that scans, updates, quarantine actions, policy corrections, patches, credential actions, or other assigned remediation steps were completed and produced the expected result.
• Tool Coverage and Health Review: Identify inactive agents, outdated components, missed check-ins, policy mismatches, logging gaps, duplicate assets, and other conditions that weaken security visibility or protection.
• Ticketing and Reporting: Maintain accurate, factual, and timely incident records; avoid speculation and clearly distinguish confirmed facts, working assessments, pending validation, and required decisions.