Cybersecurity Analyst Tier 1

The University of Utah is hiring a Cybersecurity Analyst Tier 1 for its Security Operations Center. The role monitors security systems, triages and responds to alerts, documents investigations, and supports threat analysis and incident response using established playbooks.

What you'll do:

• Perform initial triage, scoping, and evaluation of security alerts across endpoint, network, cloud, and identity domains
• Execute established incident response playbooks for containment and remediation of low-to-medium complexity security alerts
• Escalate complex, ambiguous, or high-severity security incidents to Tier-2 analysts with clear, detailed initial investigation notes
• Accurately document incident details, triage steps, and remediation actions within the ticketing and case management systems
• Monitor SIEM , EDR , and cloud security platforms to ensure continuous operational visibility and alert hygiene
• Identify recurring false positives or noisy alerts and flag them to Tier-2/3 analysts with contextual data for rule tuning
• Utilize automated SOAR playbooks to perform basic enrichment and data collection during initial alert processing
• Review security alerts and threat feeds to recognize common adversary tactics, techniques, and procedures (TTPs)
• Map basic alert artifacts and findings to the MITRE ATT &CK framework during initial triage
• Assist Tier-2 and Tier-3 analysts during major incidents by gathering supplemental logs, contextual artifacts, and host details
• Participate in regular investigation reviews to receive feedback, improve analytical rigor, and accelerate technical growth
• Provide feedback on existing SOC playbooks and documentation to highlight operational gaps or outdated steps

What they're looking for:

• Requires a bachelor's (or equivalency) + 2 years of directly related work experience or a master's (or equivalency) degree
• Requires a bachelor's (or equivalency) + 4 years or a master's (or equivalency) + 2 years of directly related work experience
• 1–2 years of experience in an IT, system administration, or junior cybersecurity role (or equivalent hands-on lab experience / degree)
• Basic understanding of networking fundamentals ( TCP /IP, DNS , OSI model), operating system internals (Windows, Linux), and standard attack vectors (phishing, malware, web attacks)
• Exposure to enterprise SIEM platforms, EDR solutions, or log management tools
• CompTIA Security+, CySA+, Cisco CyberOps Associate, or Blue Team Level 1 (BTL1)
• Strong written communication skills for ticket documentation and a proactive desire to learn and grow within security operations

Benefits:

• Dedicated mentorship from Tier-2 and Tier-3 analysts to help advance technical skills.
• Eligible new hires with prior URS service may elect to enroll in URS before becoming eligible for retirement (usually the first day of work).