What You’ll Do

Vulnerability and Exposure Management

• Run Rapid7 InsightVM scans, maintain asset coverage and scan schedules, and keep credentialed scanning healthy.


• Prioritize findings by risk and exploitability, track remediation with IT owners, and report on SLA performance.


• Validate patches and configuration fixes, and manage exceptions through our documented risk-acceptance process.

Alert Triage and Response

• Work alerts from Rapid7 InsightIDR, SentinelOne, and Microsoft Defender, and coordinate with our 24x7 SOC on escalations.


• Flag noisy or low-value detections to the engineering team so they can be tuned.


• Support incident response by handling initial triage and containment steps per our playbooks, documenting findings, and contributing to post-incident reviews.

Endpoint Security

• Handle day-to-day SentinelOne console work: policies, exclusions, device groups, and agent health.


• Investigate threats using SentinelOne Deep Visibility and Storyline data, and perform remediation and rollback when needed.


• Work with the engineering team and Intune and Defender administrators to avoid policy gaps and conflicts.

Email Security

• Handle daily Barracuda Email Protection work: quarantine management, allow and block lists, and impersonation and phishing alerts.


• Investigate reported phishing and suspicious messages, and remove malicious email from affected mailboxes.


• Pass false positive and tuning findings to the engineering team, and support security awareness efforts with phishing trends and simulation results.

Microsoft Environment

• Review Entra ID, Active Directory, and Microsoft 365 security findings, including Secure Score and CIS benchmark gaps, and apply approved changes.


• Monitor DLP and sensitivity label alerts and handle policy match reviews.


• Partner with the infrastructure team on remediation items.

Documentation and Reporting

• Write and maintain runbooks, incident playbooks, and procedures.


• Collect evidence and support audit and compliance requests.


• Produce clear metrics and status reports for IT leadership.


• Participate in an on-call rotation for security incidents.

What You Bring

• 2 to 4 years of hands-on experience in security operations, security analysis, or a closely related IT security role.


• Experience with Rapid7 (InsightVM and/or InsightIDR) or a comparable vulnerability management or SIEM platform.


• Hands-on experience with SentinelOne or another enterprise EDR such as CrowdStrike or Defender for Endpoint.


• Experience with Barracuda or another email security gateway such as Proofpoint, Mimecast, or Check Point, and a working understanding of SPF, DKIM, and DMARC.


• Working knowledge of the Microsoft ecosystem: Active Directory, Entra ID, Microsoft 365, Intune, and Windows Server.


• Working knowledge of networking (TCP/IP, DNS, firewalls, VPN) and common attack techniques, including MITRE ATT&CK.


• Experience investigating incidents and documenting findings clearly for technical and non-technical audiences.


• Basic PowerShell scripting ability, or a willingness to learn.


• Bachelor’s degree in cybersecurity, computer science, IT, or a related field, or equivalent experience.

Nice to Have

• Familiarity with NERC CIP or other critical infrastructure compliance requirements.


• Exposure to OT/ICS environments.


• Experience with Microsoft Sentinel, KQL, or SOAR automation.


• Knowledge of NIST CSF, NIST 800-53, or CIS Controls.


• Interest in AI security and governance, including securing enterprise AI tools and managing unsanctioned AI apps.


• Certifications such as Security+, CySA+, GCIH, GSEC, SC-200, AZ-500, or CISSP (or progress toward one).