Security & Network Analyst III - Remote

Security & Network Analyst III

The Security & Network Analyst III is an experienced cybersecurity professional responsible for monitoring, protecting, and enhancing the security of The Jackson Laboratory's enterprise networks, systems, and data. This position combines advanced threat detection, incident response, threat hunting, and security engineering capabilities to proactively address emerging risks and strengthen organizational resilience. The role collaborates closely with cross-functional teams throughout JAX, providing technical expertise, supporting strategic security initiatives, and ensuring the effective implementation of cybersecurity best practices.

Key Responsibilities

• Serve as a senior analyst in JAX security and network operations with an emphasis on protection, defense, cyber defense analysis, incident handling, and network operations.
• Independently monitor, triage, investigate, and resolve alerts from SIEM, EDR/XDR, IDS/IPS, firewall, vulnerability management, identity, cloud security, and network monitoring platforms.
• Analyze logs, endpoint telemetry, authentication records, firewall events, DNS activity, proxy logs, packet captures, and network flow data to identify security events, network disruptions, misconfigurations, or performance issues.
• Work assigned tickets independently, including suspicious activity reports, endpoint/security tool alerts, firewall and connectivity requests, vulnerability findings, VPN issues, access-related issues, and service availability concerns.
• Perform initial incident response activities, including scoping, evidence gathering, containment coordination, escalation, documentation, and post-incident follow-up under established procedures.
• Troubleshoot complex issues across DNS, DHCP, routing, switching, firewall policy, VPN, wireless, identity, endpoint, and application connectivity dependencies.
• Evaluate and distinguish between false positives, benign anomalies, policy violations, operational failures, confirmed security events, and incidents requiring escalation.
• Escalate complex technical issues with clear documentation, supporting evidence, business impact, urgency, and recommended next steps for Security Engineering, Network Engineering, Infrastructure, or application teams.
• Identify recurring issues, alert quality concerns, monitoring gaps, control failures, and operational handoff problems; recommend practical improvements based on investigation trends.
• Lead vulnerability management activities by validating findings, confirming exposure, assisting with prioritization, coordinating remediation, and documenting risk-based outcomes.
• Assist with firewall rule reviews, VPN troubleshooting, network segmentation validation, network access issues, implementation validation, and post-change monitoring.
• Lead cross-functional efforts with Security Engineering and Network Engineering to enhance detection logic, alert routing, monitoring coverage, and incident response playbooks and operational procedures.
• Create and maintain knowledge base articles, troubleshooting guides, escalation procedures, ticket handling standards, and incident documentation templates.
• Mentor Security & Network Analyst I and Security & Network Analyst II team members by sharing investigation methods, reviewing escalation quality, and providing technical guidance while remaining an individual contributor.
• Participate in an on-call rotation to support after-hours incidents and ensure continuity of operations.
• This role requires limited travel (less than 10% annually) for team meetups, collaborative planning sessions, and other in-person events that foster connection, innovation, and a strong team culture.
• Perform other duties as assigned.

Knowledge, Skills, and Abilities

• Eight or more years of experience in technology, cybersecurity operations, network operations, infrastructure support, incident response, or a closely related technical role preferred.
• Four or more years of hands-on experience in a SOC, NOC, security operations, network operations, managed security, enterprise infrastructure, or hybrid security/network operations environment preferred.
• Demonstrated ability to work independently on complex tickets, alerts, incidents, and troubleshooting tasks with limited supervision and strong judgment on when to escalate.
• Strong working knowledge of TCP/IP, DNS, DHCP, routing, switching, VPNs, firewalls, proxy services, wireless networking, endpoint security, identity and access management, and common enterprise security controls.
• Experience using several of the following tools preferred: SIEM, EDR/XDR, IDS/IPS, firewall management platforms, vulnerability scanners, packet capture tools, network monitoring systems, log analysi