Top Cybersecurity Analyst jobs

Investigate and respond to security alerts, hunt threats, engineer detections, and improve incident response playbooks across endpoint, identity, network, cloud, email, and data environments. Build secure automation using scripts, APIs, SOAR, and workflow platforms. Develop auditable AI agents for security investigations and response, applying least privilege, validation, safeguards, and performance monitoring. Convert investigation expertise into reusable detections, playbooks, automations, and AI-enabled capabilities.

Analyzes, detects, and resolves cybersecurity threats, anomalous activity, security controls, and system vulnerabilities for a classified Intelligence Community customer. Responsibilities include real-time threat detection, historical event correlation, log analysis, incident response planning, firewall and encryption protocol maintenance, and designing countermeasures. Preferred expertise includes SecDevOps, cloud security across AWS and Azure, and AWS Security Specialty certification.

Safeguard information assets through threat hunting, incident response, vulnerability management, penetration testing, secure network architecture, and security policy development. Maintain asset inventories, database security, access controls, disaster recovery plans, and business continuity processes. Lead security awareness training, coordinate with stakeholders and vendors, support audits, and improve the organization’s cybersecurity posture and regulatory compliance.

Manage the full lifecycle of low- to medium-severity cybersecurity incidents in a 24x7 security operations environment. Responsibilities include monitoring and triaging SIEM and EDR alerts, analyzing logs and endpoint data, containing and remediating threats, executing and refining incident response playbooks, and producing detailed incident reports. The role requires cybersecurity incident response experience, familiarity with network and endpoint forensics, strong analytical and communication skills, and the ability to obtain and maintain security clearance.

Analyzes cybersecurity threat-management information using established procedures, standard practices, and professional judgment. The role solves routine problems, exchanges information, supports team objectives, and delivers assigned contributions within deadlines. It requires conceptual knowledge of cybersecurity theories, practices, and procedures, along with general business knowledge gained through education or experience.

Supports vulnerability management, application security testing, and penetration testing across on-premises and cloud environments. Responsibilities include vulnerability scanning and triage, SAST and DAST testing, web, mobile, and API penetration testing, manual validation, remediation coordination, CI/CD security integration, and reporting. The role collaborates with engineering, IT, risk, audit, and compliance teams to reduce security risk and meet regulatory expectations.

Participate in Citi’s summer technology analyst program through training, mentoring, networking, and real-world projects. Responsibilities may include developing microservices and web applications, applying generative AI, analyzing data, strengthening cybersecurity defenses, supporting enterprise resiliency, and contributing to strategic technology initiatives. Collaborate with global, cross-functional teams while building technical, business, communication, and leadership skills.

Designs, implements, and optimizes security controls protecting enterprise systems, data, and users. Leads cybersecurity initiatives spanning security operations, cloud security, identity and access management, data protection, AI governance, network security, and incident response. Requires hands-on expertise in incident response, threat detection, vulnerability management, and security architecture, along with strong cross-organizational collaboration skills.

Protects and accredits production environments by monitoring threats, responding to incidents, assessing vulnerabilities, analyzing cloud and network security, and maintaining continuous compliance. Responsibilities include developing A&A packages, SSPs, POA&Ms, and NIST 800-53 documentation; interpreting Rapid7 scans; analyzing logs and network traffic; supporting AWS security; and creating Tableau dashboards. The role is full-time onsite in Chantilly, Virginia and requires an active TS/SCI clearance with a full-scope polygraph.

Supports Department of Defense cybersecurity authorization efforts for cloud, hybrid, and vendor-supported systems. Executes RMF and ATO activities, develops and maintains authorization documentation, coordinates security control implementation, tracks vulnerabilities and POA&M items, supports continuous monitoring, and collaborates with system owners, engineers, assessors, vendors, and interagency stakeholders. Identifies risks, documentation gaps, dependencies, and authorization blockers while driving packages toward completion.

Provides cybersecurity Assessment and Authorization support for USSOCOM systems under DoD and Intelligence Community RMF requirements. Performs risk, vulnerability, compliance, and security control assessments; develops A&A packages, POA&Ms, ISCM plans, and authorization documentation. Uses ACAS, Nessus, SCAP, STIGs, and cybersecurity management tools to validate system security. Advises stakeholders on risk mitigation, connection approvals, vulnerabilities, and cybersecurity policies while coordinating with DoD, DIA, NSA, DISA, and USCYBERCOM organizations.

Investigate and respond to sophisticated security threats across Microsoft’s ecosystem. Responsibilities include analyzing alerts and telemetry, determining incident scope and root cause, coordinating containment and remediation, improving detection logic and automation, and collaborating with threat intelligence, engineering, product, and research teams. The role also contributes to documentation, mentorship, operational excellence, and security strategy within a globally distributed 24/7 investigations team.

Supports Department of Defense cybersecurity authorization and compliance activities for assigned systems. Develops and maintains RMF and ATO packages, coordinates security control implementation, tracks vulnerabilities and remediation, and manages cybersecurity documentation across cloud, hybrid, and vendor-supported environments. Collaborates with system owners, engineers, assessors, PMOs, and vendors to resolve authorization gaps, manage deadlines, identify risks, and sustain compliance throughout system development and operations.

Develop and implement secure cloud configurations aligned with security frameworks. Assess risks from misconfigured services, create security guardrails and configuration checks, deploy cloud resources, conduct software and web-asset scans, and recommend security technologies. The role also supports cybersecurity engineering projects and requires hands-on experience with Linux, Windows, networking, firewalls, scripting, and securing complex environments.

Support cybersecurity assessments, risk remediation, incident response processes, Zero Trust and IAM modernization, cloud security, continuous monitoring, authorization maintenance, and automated compliance programs. The role includes control testing, evidence collection, POA&M management, security dashboards, third-party assurance, and leadership reporting across federal and defense environments. It requires hands-on analysis and remediation of security issues, collaboration across security and technology teams, federal contracting experience, active Secret clearance, U.S. citizenship and residency, and up to 60% travel.

Develops cybersecurity awareness campaigns, training, communications, and educational content for technical and non-technical employees. Delivers training on phishing, social engineering, AI, data protection, passwords, MFA, and secure online behavior. Organizes awareness events, collaborates with cybersecurity and communications stakeholders, uses Microsoft 365 and approved AI tools, and tracks engagement and campaign effectiveness.

Develops cybersecurity awareness campaigns, training, communications, and events that promote secure employee behaviors. Creates content for technical and non-technical audiences covering phishing, social engineering, AI, data protection, passwords, MFA, and online security. Collaborates with cybersecurity, communications, and learning teams, uses Microsoft 365 and approved AI tools, and tracks engagement and campaign effectiveness.

Lead the design, implementation, and continuous improvement of global network security architecture across enterprise, cloud, remote-access, and industrial IT/OT environments. Administer firewalls, segmentation, VPN, SASE/SSE, IDS/IPS, and related controls; conduct assessments and hardening; support incident response; manage changes, upgrades, resilience, and documentation; and coordinate security initiatives with infrastructure, cloud, SOC, plant engineering, and external providers.

Leads advanced threat hunting, adversary emulation, event reconstruction, forensic analysis, intrusion detection, and custom query development across Windows and non-Windows environments. The role analyzes endpoint and network data, identifies security gaps, matures threat-hunting processes, collaborates across security teams, and advises leadership on significant threats and vulnerabilities.

Provides cybersecurity Assessment and Authorization support under DoD and Intelligence Community RMF requirements. Assesses networks, systems, cloud environments, applications, hardware, and devices for compliance with NIST, STIG, DoD, DIA, NSA, and related standards. Develops A&A packages, POA&Ms, risk reports, ISCM plans, and authorization documentation for ATO, IATT, and ATC decisions. Performs vulnerability scanning, compliance validation, risk mitigation, and cybersecurity posture reporting while coordinating with administrators, authorizing officials, and defense organizations.

Supports cybersecurity compliance across contracts by reviewing requirements, developing security plans and training documentation, identifying gaps, preparing for audits, investigating incidents, and assisting with access control and documentation. The role also provides backup desktop support, supports facility moves and B2B requests, uses ticketing systems, and assists the Security IT program manager. Work is primarily in-office at least three days weekly, with occasional physical lifting and client meeting support.

Conduct OT and ICS inventories at DoD facilities, assess network architecture and cybersecurity compliance, create topology and dataflow diagrams, oversee field teams, coordinate site visits, and recommend remediation aligned with RMF, DoD standards, and UFC requirements. The role requires extensive domestic and international travel, customer collaboration, project reporting, and technical assessment of critical building systems.

Serve as a Principal SOC Analyst supporting federal cyber missions. Requires 5+ years experience, technical training or degree, required IAT II/CSSP/GMON/SCCU certifications, active Top Secret/SCI clearance and ability to obtain a polygraph. Work onsite supporting SOC operations, threat monitoring, and incident response.

Supports security operations through alert monitoring, incident triage, evidence collection, log analysis, phishing investigations, vulnerability management, identity and access reviews, audits, compliance documentation, and security awareness activities. The role collaborates with IT and business teams to remediate vulnerabilities, maintain operational records, escalate incidents, and improve defensive processes across endpoint, cloud, network, identity, and application environments.

Manages user access and application security, monitors and reports access or cybersecurity incidents, and performs remediation according to company policies. Collaborates with Infrastructure, Compliance, and Risk teams. The role requires experience in cybersecurity, infrastructure or applications, access services, Microsoft Azure, service desk operations, and Microsoft Office applications.