Cybersecurity Analyst (Incident Response & XDR Specialist)

Job Title: Security Analyst

Location: Tallahassee, FL

Duarion: 12 Months with possible extension

Pay Rate: $55/hr on W2 OR $65/hr on 1099

Scope of Work The selected applicant will be expected to perform some combination of the following tasks:

• Monitor security platforms, including SIEM, EDR, and cloud-native security tools for indicators of compromise, indicators of attack, and incident response requirements.
• Utilize Microsoft Defender XDR components (Endpoint, Cloud Apps, Identity, Office 365) extensively for monitoring, analysis, and response.
• Identify, triage, and investigate phishing incidents including those submitted manually by end-users.
• Perform Identity and Access Management activities with a focus on identifying and managing risky users, risky sign-ins, and sign-in event correlation.
• Conduct in-depth investigations of security alerts, perform triage, and escalate or resolve incidents according to established procedures.
• Produce thorough documentation including after-action reports and lessons learned, aligned with incident severity and organizational standards.
• Adhere to strict threat-escalation policies based on incident classification, threat type, and statutory requirements.
• Support the full incident response lifecycle: detection, containment, eradication, recovery, and post-incident reporting.
• Maintain, tune, and optimize security detection rules, alerts, and automations to reduce false positives and improve detection accuracy (with proper approvals).
• Follow established change-management processes for all configuration or detection-control modifications.
• Stay informed on emerging threats, evolving attack techniques, and advancements in security technologies.
• Assist with development and implementation of security policies and procedures.
• Prepare security documentation.
• Develop risk analysis and security reporting.
• Monitor and remediate software or hardware vulnerabilities.
• Evaluate current and future security tools and systems.
• Document hours worked by task(s).
• Follow IT processes and coordinate with other FWC IT staff to ensure compliance with FWC standards.
• Complies with and enforces all agency policies, procedures, and security policies.
• Provide Technical Training (Knowledge Transfer), as required for Office of Information Technology Support Staff as related to Information Technology security.
• Work location will be a combination of on-site at offices in Tallahassee, Florida and remote work based on situation, to be defined on a project basis.
• The deliverables and performance standards associated with each task identified in this scope of work are further defined in the Standards and Specifications table below.

Qualification Requirements for Contractor

• Four or more years of combined IT and security work experience within a cybersecurity-related discipline.
• Three or more years of experience working with KQL, Python, PowerShell, or batch.
• Two or more years of experience with cloud computing and cloud computing security.
• Requires knowledge of security issues, techniques, and implications across all existing computer platforms.
• Demonstrate fundamental understanding of regulatory frameworks and standards such as NIST 800-53r5, CJIS Security Policy, and 60GG-2.
• Strong communication and documentation skills.
• Apply strong analytical and critical thinking skills to drive effective decision-making during security events.
• Demonstrates efficient stress management and remains composed during high pressure security incidents.
• Must have a good understanding of MITRE framework including TTPs.
• Must be CJIS certified or can become CJIS certified.

Education

• Bachelor’s degree or higher in Computer Science, Information Security, or a related field.
• Additional relevant experience may substitute for the recommended educational level on a year-for-year basis and additional relevant education may substitute for the recommended experience on a year-for-year basis.

Relevant certifications

such as Security+, CySA+, Network+, SSCP, CISSP, CCSP, SecurityX/CASP+, or PenTest+.