Cybersecurity Analyst

Berkeley Research Group (BRG)

. Monitor, triage, investigate, document, and coordinate response to security alerts, incidents, tickets, and suspicious activity across Microsoft and third-party security platforms .

Posted 11/6/2026full-timeRemote • United StatesMid-LevelSenior💰 $90,000 - $120,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cybersecurity operations, particularly in Microsoft Azure security, identity security, and incident response. Proficient in managing security alerts, implementing security baselines, and utilizing cloud security tools to enhance organizational security posture.

Highest-signal resume keywords

Microsoft Azure SecurityIncident ResponseEmail Security WorkflowsCloud Security Posture ManagementSecurity Certifications

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cybersecurity OperationsIdentity SecuritySecurity EngineeringSecurity BaselinesVulnerability ManagementAlert AnalysisAuthentication ConceptsRisk AssessmentPolicy TestingGovernance Reviews

Soft Skills

Analytical SkillsDocumentation SkillsCollaborationCommunication

Tools & Technologies

Microsoft Entra IDActive DirectoryMicrosoft DefenderDefender for CloudSentinelMicrosoft PurviewProofpointTenable Cloud SecurityNetskopeAI Security Tools

Certifications & Qualifications

Microsoft Certified: Security Operations Analyst Associate (SC-200)CompTIA Security+CompTIA CySA+GIAC Certifications

Industry Keywords

NIST CSFCIS ControlsSOC 2ISO 27001/27002HIPAAHITRUSTCloud SecurityPhishing ResponseConditional AccessPrivileged Access Management

Tech Stack

Tools & technologies

AzureCloudCyber SecurityMacOS

About the role

Key responsibilities & impact

Monitor, triage, investigate, document, and coordinate response to security alerts, incidents, tickets, and suspicious activity across Microsoft and third-party security platforms
Investigate alerts with BRG’s managed security provider, validate activity, track remediation, and improve alert quality and operational workflows
Administer and support Microsoft security capabilities across Azure, Microsoft Entra ID, Active Directory, Microsoft Defender, Defender for Cloud, Sentinel, and Microsoft Purview within approved role and change-control boundaries
Review Azure security recommendations, policies, and configuration findings; help test, document, and implement Azure Policy initiatives, security baselines, and control exceptions
Support identity security operations, including Conditional Access, privileged access and PIM reviews, role lifecycle activities, stale-account cleanup, authentication controls, service accounts, guest access, and privileged-group monitoring
Support Proofpoint email security, phishing-reporting workflows, Threat Response capabilities, account-takeover protections, security-awareness integrations, and email-policy tuning
Use Tenable Cloud Security and related vulnerability-management capabilities to review cloud exposure, attack paths, asset coverage, security findings, and remediation status
Support Netskope cloud-app and traffic-steering policies, including application discovery, policy testing, AI-application controls, exception handling, and validation of user impact
Assess security risks associated with generative AI and other AI-enabled services; support AI application inventory, usage monitoring, access controls, policy testing, and governance reviews
Investigate email, identity, endpoint, cloud, and application activity using available logs and evidence; escalate confirmed or potentially significant events through the incident-response process
Track vulnerabilities and security recommendations, identify technical owners, validate remediation evidence, document accepted risks or exceptions, and report status to stakeholders
Create and maintain operating procedures, configuration records, support documentation, security metrics, dashboards, and audit/control-review evidence
Participate in change reviews and validate cybersecurity-owned changes include testing, implementation, rollback, communication, and post-change evidence
Evaluate security tools and features, perform structured testing, document findings, and recommend improvements to security controls and operations
Participate in risk assessments, tabletop exercises, incident-response activities, cross-training, and an on-call or escalation rotation as required
Partner with IT Leadership, technical teams, Infrastructure, Network, Service Desk, Risk and Compliance, and external security partners to align technologies, investigate issues, apply controls, and coordinate remediation

Requirements

What you’ll need

3+ years of experience in cybersecurity operations, cloud security, identity security, security engineering, or a closely related role
Working knowledge of Microsoft Azure security, Microsoft Entra ID, Active Directory, Azure Policy, Conditional Access, PIM, Defender, Defender for Cloud, Sentinel, and Purview
Experience interpreting and applying security baselines such as Microsoft security baselines and CIS Benchmarks, including testing, exception documentation, and remediation tracking
Hands-on familiarity with email security and phishing-response workflows; Proofpoint experience is strongly preferred
Experience with cloud security posture management or CNAPP capabilities; Tenable Cloud Security experience is preferred
Experience with secure web gateway, cloud access security broker, or SaaS application-control platforms; Netskope policy and traffic-steering experience is preferred
General knowledge of AI security risks, including sensitive-data exposure, unapproved AI services, prompt and response monitoring limitations, application categorization, access control, and governance
Understanding of common identity and authentication concepts, including MFA, passwordless authentication, OAuth, SAML, Kerberos, privileged access, and least privilege
Ability to analyze alerts and logs, distinguish expected administration from suspicious activity, develop a defensible timeline, and clearly document conclusions and follow-up actions
Experience working with a SOC, MDR provider, or other outsourced monitoring partner
Familiarity with Windows, macOS, cloud platforms, enterprise SaaS, and hybrid identity environments
Knowledge of common security and compliance frameworks such as NIST CSF, CIS Controls, SOC 2, ISO 27001/27002, HIPAA, or HITRUST
Relevant security certifications such as Microsoft Certified: Security Operations Analyst Associate (SC-200), CompTIA Security+, CompTIA CySA+, GIAC certifications, or comparable credentials are preferred
Candidate must be able to submit verification of his/her legal right to work in the U.S., without company sponsorship