Network Security Analyst Job Description Template

Network Security Analyst Location: [City, State / Hybrid / On-site required] Department: Information Security / SOC Reports to: Security Operations Manager / CISO Shift: [Business hours / Rotating shifts / 24x7 on-call] Salary range: $[XX,000] – $[XX,000] Clearance: [Not required / Active Secret / TS/SCI required] About [Company] [Company] is a [industry] organization with [X] employees across [X] locations. Our security team is responsible for protecting [describe the environment: on-premise data centers, hybrid cloud infrastructure, SaaS-heavy operations, or regulated data — e.g., PCI cardholder data, PHI, classified systems]. Role overview As a Network Security Analyst at [Company], you will be a core member of our [in-house / hybrid managed] SOC, responsible for monitoring and analyzing security events across our network and cloud environments, triaging and escalating incidents, and supporting ongoing threat detection and vulnerability management programs. This is a Tier [2 / 3] role — you will handle escalations from [Tier 1 / MSSP] and take ownership of investigation, containment, and documentation through to resolution. Responsibilities Monitoring & Detection • Monitor SIEM dashboards and alerts in [Splunk / Microsoft Sentinel / IBM QRadar / other] for indicators of compromise, anomalous behavior, and policy violations • Analyze network traffic using [Wireshark / Zeek / Darktrace / NDR platform] to identify suspicious patterns, lateral movement, and data exfiltration attempts • Tune detection rules, correlation queries, and alert thresholds to reduce false positive rates while maintaining detection coverage • Maintain and improve threat detection playbooks and runbooks for common alert categories Incident Response • Triage, investigate, and escalate security incidents following documented IR procedures • Perform host and network forensics to determine scope, root cause, and impact of security events • Coordinate containment and remediation actions with endpoint, infrastructure, and application teams • Document incident timelines, findings, and lessons learned in the ticketing system ([ServiceNow / Jira / other]) • Participate in post-incident reviews and contribute to improved detection and response capabilities Vulnerability Management • Assist with vulnerability scanning using [Nessus / Qualys / Rapid7] and prioritize findings based on exploitability, asset criticality, and threat intelligence • Track remediation progress with system owners and escalate overdue findings according to SLA policies • Provide vulnerability risk context to infrastructure and application teams Compliance & Reporting • Support audit and compliance activities for [PCI-DSS / HIPAA / SOC 2 / NIST 800-53 / ISO 27001] as required • Prepare regular security metrics reports for security leadership covering alert volumes, incident trends, and mean time to respond/resolve • Maintain accurate asset inventory and network topology documentation for the environments you monitor Qualifications • 3+ years of experience in a security operations, network security, or SOC analyst role • Hands-on experience with at least one enterprise SIEM platform: Splunk, Microsoft Sentinel, IBM QRadar, or Elastic SIEM • Strong understanding of TCP/IP networking, DNS, HTTP/S, TLS, VPN protocols, and common network attack techniques (reconnaissance, lateral movement, C2 communications) • Experience with firewall platforms and log analysis: [Palo Alto / Fortinet / Cisco ASA] • Familiarity with EDR solutions: [CrowdStrike Falcon / SentinelOne / Microsoft Defender for Endpoint] • Understanding of MITRE ATT&CK framework and how to map observed TTPs to threat actor behaviors • Experience with vulnerability management tools: [Nessus / Qualys / Rapid7 Nexpose or InsightVM] • Strong analytical and documentation skills — you produce clear, evidence-based incident reports Certifications (preferred) • CompTIA Security+, CySA+, or equivalent foundational certification • GIAC GCIA, GCIH, or GPEN • [Platform-specific: Splunk Certified Power User / CrowdStrike Certified Falcon Responder] • [Compliance-specific: PCI ISA / CISA for audit-heavy roles] What we offer • Competitive salary: $[XX,000] – $[XX,000] • [Health / dental / vision insurance] • [Remote / hybrid work policy — describe shift flexibility] • Certification training and exam reimbursement • SOC tooling investment — we don't ask analysts to fight with inadequate tools • [Other benefits] How to apply Submit your application at [link] with your resume. Including a brief description of a notable security incident you investigated or a detection improvement you implemented will strengthen your application.