Job description

At Ensono, our Purpose is to be a relentless ally, disrupting the status quo and unleashing our clients to Do Great Things ! We enable our clients to achieve key business outcomes that reshape how our world runs. As an expert technology adviser and managed service provider with cross-platform certifications, Ensono empowers our clients to keep up with continuous change and embrace innovation. We can Do Great Things because we have great Associates. The Ensono Core Values unify our diverse talents and are woven into how we do business. These five traits are the key to achieving our purpose: Honesty, Reliability, Curiosity, Collaboration, and Passion. About the role and what you'll be doing: At Ensono, security is more than monitoring alerts. It is about protecting our business and our clients through proactive detection, rapid response, and informed decision-making. We're looking for a Senior Security Analyst to join our Security Operations team and serve as a critical member of our incident response capability. In this role, you'll investigate and respond to security events, analyze threats across a complex enterprise environment, and work closely with both internal teams and customers to contain and remediate security incidents. You'll act as a senior escalation point for security investigations, helping to distinguish real threats from noise while ensuring incidents are resolved quickly and effectively. This role is part of a broader incident response function and plays a key role in providing operational coverage and support for customer security environments. After-hours and/or on-call duty is required. Responsibilities include: Strong technical writing skills to include the ability to provide clearly written and detailed reports on projects for communication to leaders The monitoring and administration of information security solutions Fill a Senior role in monitoring and responding to security incidents Collect evidence to support internal and customer audit requirements Create internal and customer facing security playbooks and procedures Align to procedures, processes, and security tools to support a single global cybersecurity model Provide guidance to and mentorship to junior members of the Security Operations team Perform incident response roles as necessary per the Ensono Incident Response Plan Implement security application upgrades and patches Investigate security events, threats, and vulnerabilities Follow project plans and meet timelines and milestones Assist with the creation and maintenance of security metrics Collaborate across team to create and tune security alerts Proactively learn new technologies and tooling capabilities throughout the workday Assist product owners to ensure alignment of solutions to security product offerings Operate effectively in a fast‑paced enterprise environment, independently prioritizing tasks to meet competing demands We want all new Associates to succeed in their roles at Ensono. That's why we've outlined the job requirements below. To be considered for this role, it's important that you meet all Required Qualifications. If you do not meet all of the Preferred Qualifications, we still encourage you to apply.     Required Qualifications 5+ years of progressive cybersecurity experience, including at least 3 years of hands-on Security Operations Center (SOC) experience supporting security monitoring, alert triage, incident investigation, escalation management, and incident response. Experience leading or independently handling security investigations and incident response activities within a large enterprise, managed services, MSSP, MDR, or multi-customer environment. 2+ years of hands-on experience with Microsoft Sentinel in a production environment, including alert investigation, log analysis, incident management, threat detection, and security monitoring. 2+ years of hands-on experience with Microsoft Defender technologies, including the investigation and response of endpoint, identity, email, and cloud security incidents. Experience working with Security Information and Event Management (SIEM) platforms and security monitoring tools to identify, investigate, and respond to security threats. Experience distinguishing true-positive security events from false positives and making risk-based decisions in operational environments. Experience communicating security incidents, technical findings, business impact, and remediation recommendations to technical and non-technical stakeholders, including customers. Experience creating and maintaining incident documentation, investigation records, security procedures, runbooks, and response playbooks. Strong understanding of TCP/IP networking, DNS, firewalls, encryption technologies, security controls, and common attack vectors. Strong understanding of malware classification, attack methodologies, infection vectors, persistence mechanisms, and threat actor techniques. Experience with digital forensics concepts, evidence preservation, log analysis, and investigative methodologies. Experience evaluating vulnerability scan results and assessing vulnerability risks within enterprise environments. Working knowledge of Microsoft Entra ID, Microsoft 365, Azure, vulnerability management processes, and privileged access management concepts. Experience with Data Loss Prevention (DLP), endpoint security technologies, anti-malware solutions, and host-based intrusion detection/prevention concepts. Experience using KQL, PowerShell, Python, SQL, or similar tools to support security investigations and operational efficiency. Strong written and verbal communication skills with the ability to perform effectively during high-pressure security incidents. Bachelor's Degree in Cybersecurity, Information Security, Computer Science, Information Systems, Engineering, or a related field, or an equivalent combination of education and relevant professional experience. Preferred security tooling experience: Experience with Trend Vision One, Trend Micro security technologies, or other XDR platforms. Experience with threat hunting, detection engineering, security automation, orchestration, and SOAR workflows. Experience with Security-as-a-Service (SECaaS) security platforms. Knowledge of network and cloud security concepts, including virtual firewalls, cloud-native security controls, and container technologies. Familiarity with file integrity monitoring (FIM) technologies. Experience supporting compliance and security frameworks such as PCI-DSS, SOC 1/SOC 2, GDPR, HIPAA, IRS Publication 1075, NIST, and ISO 27001 Certifications Required One or more of the following certifications are highly desired: Microsoft Certified: Security Operations Analyst Associate (SC-200) GIAC Certified Incident Handler (GCIH) GIAC Certified Forensic Analyst (GCFA) GIAC Certified Intrusion Analyst (GCIA) CompTIA CySA+ Certified Ethical Hacker (CEH) Certified Information Systems Security Professional (CISSP) Why Ensono? Ensono is a place to make better happen – for our clients and for your career. You can do great things through innovation or collaboration, by learning or volunteering, or to promote diversity and inclusion. You can do great things for your own health or for a healthier planet. Whatever it means to you to do great things we want Ensono to be the place you can do it. We are a client-facing business, but we do encourage clients to allow us to work remotely most of the time so if you are not required to be on a client site, you can choose to work from home or in our Ensono offices. Some of our benefits include: Unlimited Paid Days Off Three health plan options 401k with company match Eligibility for dental, vision, short and long-term disability, life and AD&D coverage, and flexible spending accounts Family Forming Benefit including fertility coverage and adoption/surrogacy reimbursement Paid childbearing and paternal leave Education Reimbursement, Student Loan Assistance or 529 College Funding Sabbatical leave Wellness program Flexible work schedule As of the date of this posting, a good faith estimate of the current pay scale for this role is $100,000 to $125,000 annually based on a full-time schedule. Please note that placement in the range may vary based on numerous factors including but not limited to skills, experience, internal equity, and business needs. In addition to base salary, other compensation programs, depending on eligibility, include an annual bonus plan based on company and individual performance and an equity grant under our Associate Equity Appreciation Program. Ensono is an Equal Opportunity/Affirmative Action employer. We are committed to providing equal employment to our Associates and building a diverse and inclusive workforce. All qualified applicants will be considered without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, disability, or other legally protected basis, in accordance with applicable law. Pay transparency nondiscrimination statement/posting OFCCP’s pay transparency policy can be found on OFCCP’s website . If you need accommodation at any point during the application or interview process, please let your recruiter know or email USTalentAcquisition@ensono.com

Requirements

Must-haves

After-hours and/or on-call duty is required.
Strong technical writing skills to include the ability to provide clearly written and detailed reports on projects for communication to leaders
The monitoring and administration of information security solutions
Fill a Senior role in monitoring and responding to security incidents
Collect evidence to support internal and customer audit requirements
Create internal and customer facing security playbooks and procedures
Align to procedures, processes, and security tools to support a single global cybersecurity model
Provide guidance to and mentorship to junior members of the Security Operations team
Perform incident response roles as necessary per the Ensono Incident Response Plan
Implement security application upgrades and patches
Investigate security events, threats, and vulnerabilities
Follow project plans and meet timelines and milestones
Assist with the creation and maintenance of security metrics
Collaborate across team to create and tune security alerts
Proactively learn new technologies and tooling capabilities throughout the workday
Assist product owners to ensure alignment of solutions to security product offerings
Operate effectively in a fast‑paced enterprise environment, independently prioritizing tasks to meet competing demands
Experience leading or independently handling security investigations and incident response activities within a large enterprise, managed services, MSSP, MDR, or multi-customer environment.
2+ years of hands-on experience with Microsoft Sentinel in a production environment, including alert investigation, log analysis, incident management, threat detection, and security monitoring.
2+ years of hands-on experience with Microsoft Defender technologies, including the investigation and response of endpoint, identity, email, and cloud security incidents.
Experience working with Security Information and Event Management (SIEM) platforms and security monitoring tools to identify, investigate, and respond to security threats.
Experience distinguishing true-positive security events from false positives and making risk-based decisions in operational environments.
Experience communicating security incidents, technical findings, business impact, and remediation recommendations to technical and non-technical stakeholders, including customers.
Experience creating and maintaining incident documentation, investigation records, security procedures, runbooks, and response playbooks.

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

azurepythonsql

Platform: greenhouse
Effort: quick

Benefits

Benefits detected in the listing.

Dental

Vision

401k

Wellness