SR Security Analyst

Sterling Infrastructure is looking for a SR Security Analyst to join their growing IT Team!

About the Role

Sterling Infrastructure is continuing to mature its cybersecurity program. We are looking for a Senior Security Analyst to serve as the technical lead for incident response across Sterling and its operating companies.

In this role, you will lead the technical response to significant security incidents, from initial triage and investigation through containment, recovery, and post-incident review. You will work closely with the Cybersecurity team, our managed detection and response (MDR) partner, and IT teams across the organization.

This is a hands-on role for someone who has independently handled complex security incidents, can make sound decisions with incomplete information, remains composed under pressure, and wants to help strengthen the incident response capabilities of a growing cybersecurity program.

What You'll Do

Incident Response | Primary Focus

• + Lead significant security incidents from initial triage through scoping, containment, eradication, recovery, and post-incident review; provide escalation support and oversight for lower-severity incidents.

+ Investigate email, identity, and business email compromise (BEC) incidents across Microsoft 365 and Entra ID, including sign-in activity, authentication changes, mailbox access, mail-flow activity, OAuth and application activity, and persistence mechanisms.

+ Perform forensic triage of endpoints and servers using memory, disk, EDR, and log artifacts, and coordinate deeper forensic analysis when required.

+ Serve as the technical escalation point for alerts and investigations from our MDR partner and coordinate response activities with affected Cybersecurity and IT teams.

+ Build, maintain, and continuously improve the incident response plan, severity matrix, technical response procedures, and incident-specific playbooks.

+ Develop scripts, queries, and repeatable workflows to automate evidence collection, enrichment, incident scoping, and common response activities.

+ Plan and facilitate tabletop exercises for both technical teams and leadership to validate response procedures and identify opportunities for improvement.

+ Preserve forensic evidence and maintain appropriate evidence-handling and chain-of-custody documentation.

+ Produce clear incident reports, investigation findings, timelines, and briefings for both technical teams and leadership.

+ Track and analyze incident response metrics, including time to detect, time to contain, time to recover, incident trends, and recurring root causes.

+ Identify lessons learned from incidents and work with appropriate teams to improve controls, detection capabilities, and response procedures.

Detection and Threat Hunting

• + Develop and tune SIEM searches, queries, and detections based on observed attacker techniques and organizational risk.

+ Map detection coverage and identified gaps to MITRE ATT&CK where appropriate.

+ Conduct targeted threat hunts using threat intelligence, observed indicators, attacker behaviors, and lessons learned from previous incidents.

+ Identify logging, telemetry, and visibility gaps that affect detection or investigation capabilities and work with appropriate teams to address them.

+ Translate findings from incidents and threat hunts into improved detections and investigation procedures.

Program Support

• + Validate organizational exposure to actively exploited and high-risk vulnerabilities and provide risk-based remediation recommendations to vulnerability management and infrastructure teams.

+ Support cybersecurity assessments of newly acquired companies and help integrate them into Sterling's security monitoring, detection, and incident response processes.

+ Mentor other security analysts through shared investigations, technical reviews, knowledge transfer, and runbook development.

+ Contribute to the continued maturity of Sterling's security operations and incident response capabilities.

What You Bring - Required

• + 5+ years of experience in security operations, incident response, or digital forensics, including at least 3 years independently leading security investigations and response activities.

+ Demonstrated experience leading complex security incidents, making containment recommendations with incomplete information, and coordinating technical response across multiple teams.

+ Strong Microsoft 365 and Entra ID investigation skills, including Entra sign-in and audit logs, Microsoft Purview audit logs, mailbox activity and rules, authentication methods, Conditional Access, and related identity activity.

+ Practical experience investigating business email compromise, account takeover, phishing, credential theft, and other identity-based attacks.

+ Hands-on experience with enterprise EDR and SIEM platforms, including the ability to develop and troubleshoot your own investigative queries.

+ Experience performing endpoint and server forensic triage using EDR telemetry, Windows event logs, memory, disk, and other available forensic artifacts.

+ Solid understanding of Windows internals, Active Directory, authentication, and networking fundamentals, including TCP/IP, DNS, firewalls, and VPN technologies.

+ Working knowledge of common attacker tactics, techniques, and procedures and frameworks such as MITRE ATT&CK.

+ Scripting skills in PowerShell or Python with the ability to automate evidence collection, data analysis, enrichment, or repetitive investigation tasks.

+ Strong analytical and problem-solving skills, including the ability to distinguish confirmed findings from assumptions and identify gaps in available evidence.

+ Strong written and verbal communication skills, including the ability to explain technical findings, risk, and incident impact clearly to both technical teams and leadership.

+ Ability to remain composed and make sound technical decisions during high-pressure security incidents.

+ Willingness to participate in the cybersecurity on-call rotation and respond after hours when required during active incidents.

Preferred

• + Certifications such as GCIH, GCFA, GCFE, or GNFA.

+ Experience investigating incidents in complex, multi-company, decentralized, or M&A environments with mixed technology and security tool stacks.

+ Experience working with managed detection and response providers and coordinating investigations between internal and external security teams.

+ Experience developing or facilitating cybersecurity incident response tabletop exercises.

Education

• + Bachelor's degree in cybersecurity, computer science, information technology, or equivalent combination of professional experience, training, and education.

We are an equal opportunity employer

We do not discriminate based on race, color, national origin, religion, creed, sex, sexual orientation, gender identity, disability, age, genetic information, marital status, military status, membership or activity in a local human rights commission, or status with regard to public assistance, or any other characteristic protected by applicable law.

#LI-ER1