• Investigate security alerts using tools such as CrowdStrike Falcon Suite, Microsoft Sentinel, endpoint telemetry, identity logs, network data, and cloud security sources. • Perform alert triage and analysis to determine the scope, severity, and potential impact of security events. • Support incident response activities, including investigation, containment, remediation, recovery, and post-incident documentation. • Participate in rotational on-call escalation coverage for higher-priority security events outside normal business hours, as needed. • Write clear incident reports, investigation summaries, timelines, findings, and recommended improvements. • Support selected SOC projects focused on improving detection quality, workflows, playbooks, reporting, automation, and response readiness. • Participate in regular security operations reviews and collaborate with cross-functional teams, including Security Engineering, Threat and Vulnerability Management, Networking, Infrastructure, Identity, and IT Operations.

Role Description Harvest is seeking a Cybersecurity Operations Analyst II to join our team on a full-time basis. The Cybersecurity Operations Analyst is responsible for protecting the organization's information systems through the administration of security technologies, continuous monitoring, vulnerability management, incident response, and operational security initiatives. This position works closely with IT teams to maintain a secure environment while supporting the organization's compliance objectives. - Monitor, investigate, and respond to security events, alerts, and incidents across endpoint, identity, cloud, and network security platforms. - Administer and maintain cybersecurity technologies including endpoint protection, vulnerability management, security logging, email security, and identity security solutions. - Perform vulnerability assessments, coordinate remediation efforts with IT teams, and validate corrective actions to reduce organizational risk. - Support security operations by maintaining security documentation, developing operational procedures, and assisting with security audits, compliance initiatives, and customer security assessments. - Participate in the implementation, configuration, and continuous improvement of security controls, technologies, and operational processes. - Assist with user access reviews, security awareness initiatives, phishing campaigns, and other activities that promote a strong security posture. - Collaborate with cross-functional teams to investigate security concerns, support infrastructure projects, and ensure security best practices are incorporated into daily operations. Qualifications - 3+ years of experience in cybersecurity, systems administration, or information technology with a security focus. - Experience administering endpoint protection, vulnerability management, security logging/SIEM, and Microsoft Windows environments. - Working knowledge of Active Directory, Microsoft 365/Azure, networking fundamentals, and incident response processes. - Strong analytical, troubleshooting, documentation, and communication skills. - Ability to manage multiple priorities while working independently and collaboratively in a fast-paced environment. Preferred Qualifications - Experience with CrowdStrike, Microsoft 365 Security, Azure, Log360 or similar SIEM platforms, and vulnerability management solutions. - Familiarity with SOC 2, CIS Controls, or the NIST Cybersecurity Framework. - Industry certifications such as Security+, CySA+, SSCP, or equivalent. Physical Requirements - Prolonged periods of sitting at a desk and working on a computer. - Ability to operate computer equipment. - Ability to occasionally walk, stand, bend, or reach when accessing equipment, cabling, or hardware components. - Ability to communicate effectively in person and via electronic means. Remote Work Environment Requirements - Dedicated, quiet workspace free from distractions to maintain focus and accuracy. - Reliable high-speed internet connection to support secure document processing and collaboration. - Ability to meet deadlines in a remote setting while maintaining attention to detail. - Strong self-discipline and time management skills to work independently and efficiently. - Comfortable using remote communication tools (e.g. email, Microsoft Teams, Zoom) for team collaboration. Benefits - This is a full-time position with competitive compensation and good work/life balance. - Health insurance. - Paid Time Off. - Disability insurance. - Paid holidays. - 401k with employer contribution. - Remote work environment. - Generally, promotion within firm.

• Responsible for the tools, configuration, administration and related processes around Security Information and Event Management. • Responsible for Web application firewall and related prevention, detection and mitigation of DDoS attack. • Performs regular firewall audits in line with our procedures and provides the appropriate documentation. • Responsible for tooling, processes and follow up actions related to vulnerability scanning. • Handles the identification, planning and implementation of cloud hardening needs. • Performs security incident analysis, response and remediation. • Participates in design and implementation of security automation workflows. • Maintain the technical documentation of processes and procedures. • Perform scripting duties in Bash and Python. • Maintain an advanced level of knowledge of JAMF Cloud Services and related products.

• Identify, assess and mitigate cyber risks and vulnerabilities, ensuring protection of the company’s assets • Manage the SIEM platform by creating, tuning and improving correlation rules and use cases, and defining severity and criticality levels for prioritization and response • Ingest new data sources into the SIEM, including maintenance, normalization/parsing of logs and integrations with internal and external systems • Perform and oversee continuous monitoring of security events and incidents using SIEM, SOAR, EDR/XDR and related solutions • Conduct threat hunting activities to proactively identify suspicious behavior and threats • Work with Threat Intelligence (production and consumption of CTI), integrate with TIPs (such as MISP), and automate IOCs • Lead investigations and incident response efforts for cyber incidents, proposing corrective and preventive actions • Create and review operational documentation and incident response playbooks/flows • Support and follow up on security tests (penetration tests) and track remediation plans • Ensure compliance with standards and regulations (PCI-DSS, ISO 27001, SOC 2, Central Bank regulations), supporting internal and external audits • Produce technical and management reports on security status and incidents handled, recommending continuous improvements • Support and participate in incident simulation exercises: tabletop, red team, blue team and purple team • Drive continuous improvement of SOC processes, workflows and maturity • Collaborate with internal teams on the ongoing evolution of information security practices • Mentor and train team members, promoting information security best practices