Cybersecurity Analyst

The Cybersecurity Analyst is a mid-level, hands-on role within Star Group's IT Security team, reporting to the Cybersecurity Engineer. This position is responsible for day-to-day security operations, monitoring, incident response support, vulnerability management, and compliance evidence collection across Star Group's corporate and field environments. The Cybersecurity Analyst works closely with the IT Security Team to maintain and mature the organization's security posture, and serves as a key operational responder for security alerts, tickets, and audit requests.

This role is well suited to a candidate with 3–5 years of hands-on security operations experience who is looking to deepen expertise across endpoint protection, network access control, secure email gateway, application allowlisting, privileged access management, SIEM/SOAR, and vulnerability management in a lean, high-ownership team environment. The role also offers the opportunity to gain exposure to the strategic development of security policies, the implementation of IT security technologies, and work with cross-functional teams to deliver targeted security solutions.

• Monitor security alerts and events generated by EDR, NAC, SIEM/SOAR, ZTA, email security, and DLP platforms; triage, investigate, and escalate per documented incident response playbooks.
• Perform first-line analysis of phishing reports, malware alerts, and suspicious activity; contain and remediate confirmed incidents in coordination with the IT Security Team.
• Support tabletop exercises and post-incident reviews; contribute to after-action reports and lessons-learned documentation.
• Maintain and tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve mean-time-to-detect/respond.
• Perform after-hours security event containment and remediation activities as needed.

• Run and review recurring vulnerability scans across servers, endpoints, and network infrastructure; validate and prioritize findings by exploitability and business risk.
• Track remediation of vulnerabilities against SLA targets, including expedited handling of CISA Known Exploited Vulnerabilities (KEV).
• Coordinate with broader IT teams on patch deployment cycles for servers, workstations, endpoint devices, and SaaS solutions; verify patch compliance reporting.
• Maintain the vulnerability management dashboard and produce recurring metrics for leadership and audit purposes.

• Assist in administering day-to-day operations of Privileged Access Management (PAM) tooling, including onboarding/offboarding privileged accounts, session review, and access certification support.
• Support Network Access Control (NAC) operations, including device onboarding, policy exceptions, and unauthorized-device investigation across 100+ sites.
• Assist with administering endpoint application control / allowlisting policy requests, exception handling, and false-positive tuning.
• Support quarterly and annual user access reviews (UAR) for in-scope systems.

• Collect, organize, and validate audit evidence in support of audit requirements, industry assessments and cybersecurity disclosure requirements.
• Track and report on security awareness training completion, phishing simulation results, and related compliance metrics.

• Maintain accurate, current documentation for security tools, configurations, and standard operating procedures (SOPs).
• Contribute to the continuous improvement of playbooks, runbooks, and automation to reduce manual effort and improve consistency.
• Assist in the evaluation and testing of new security tools and integrations under the direction of the Security Engineer and Director, IT Security.
• Support the maintenance and reporting functions of the team's internal security program dashboard, including data quality of tracked metrics.

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent combination of education and/or work experience.
• 3–5 years of hands-on experience in security operations, IT infrastructure/security, or a related technical role.
• Demonstrated experience with at least two of the following: EDR/antivirus platforms, SIEM/SOAR, network access control, privileged access management, vulnerability scanning tools, application allowlisting technology, or email security gateways.
• Experience supporting or participating in a compliance program for a publicly traded company is strongly preferred.
• Valid driver’s license, reliable transportation and ability to meet the company’s motor vehicle policy.

• Working knowledge of core security domains: endpoint protection, network security, identity and access management, and vulnerability management.
• Familiarity with Windows Server and Windows endpoint administration; working knowledge of Active Directory / Entra ID.
• Basic to intermediate scripting ability (PowerShell, Python, or similar) for automation, reporting, or log analysis.
• Understanding of networking fundamentals (TCP/IP, VLANs, firewalls, VPN) sufficient to investigate, troubleshoot, and adjudicate security events.
• Familiarity with common security frameworks (NIST CSF 2.0, NIST SP 800-53, CIS Controls, ISO 27000, Secure Controls Framework) is a plus.

One or more of the following is required or strongly preferred (candidates actively pursuing certification will be considered):

• CompTIA Security+ (required at minimum, or equivalent experience)
• GIAC certifications (e.g., GSEC, GCIH, GCIA)
• CompTIA CySA+
• CompTIA SecurityX (formerly CASP+)
• EC-Council Certified Ethical Hacker (CEH)
• ISC2 SSCP

• Strong analytical and problem-solving skills; able to triage ambiguous alerts and prioritize effectively under time pressure.
• Clear written and verbal communication skills; comfortable documenting findings for both technical and non-technical audiences.
• High degree of personal accountability and discretion when handling sensitive security and compliance information.
• Comfortable operating in a small, high-ownership team where analysts work across the full breadth of the security program rather than a single narrow specialty.
• Collaborative team player who works effectively with IT Operations, Internal Audit, and business stakeholders across a distributed, multi-site organization.

• Prior experience in a regulated or publicly traded company environment (audit and reporting obligations).
• Experience in a distributed, multi-site operating environment (retail, field services, distribution, or utilities).
• Exposure to M&A IT/security integration activities.
• Experience with cloud security fundamentals (Microsoft 365, Azure, AWS)
• Experience with SPF/DKIM/DMARC email analysis.

• Primarily an office/hybrid role based at Star Group's Woodbury, NY corporate office (based in Nassau County); standard business hours with periodic after-hours availability for incident response.
• Occasional travel (estimated 5–10%) to branch and field locations for security assessments, equipment deployment, or incident support.
• Prolonged periods of sitting and computer use; ability to lift/move IT equipment (up to 25 lbs.) occasionally.
• Must be available for after-hours security incident escalations, as needed.

Salary range: $85,000 – $100,000 annually, commensurate with experience and certifications. Final offer will be based on a combination of experience, education, certifications, and internal equity.

• Medical and dental coverage
• 401(k)
• Paid time off, holidays
• Plus more!

We are proud to be an equal opportunity employer, and is committed to a drug and alcohol-free workplace.