At CoreCivic, our employees are driven by a deep sense of service, high standards of professionalism and a responsibility to better the public good. CoreCivic is currently seeking a Security Operations Analyst I located at our corporate office in Brentwood, TN. Come join a team that is dedicated to making an impact for the people and communities we serve.
This position would require a working 4 days (Mon-Thurs) onsite in Brentwood, TN.
SUMMARY:
The Security Operations Center (SOC) Analyst I serves as the front line of the organization's cybersecurity defense program, providing continuous monitoring, initial threat detection, alert triage, and incident response support in a 24x7 operational environment. Investigates security events, validates potential threats, executes established response procedures, and escalates complex incidents to higher-tier analysts. Works closely with users, IT teams, and security personnel to protect enterprise systems, minimize risk, and ensure timely resolution of security-related issues.
ESSENTIAL FUNCTIONS:
The incumbent should be able to perform all of the following functions at a pace and level of performance consistent with the job performance requirements.
- Monitors, analyzes, and triages security events and alerts generated by security technologies, including SIEM, endpoint protection platforms, firewalls, IDS/IPS, email security solutions, and other detection tools. Identifies suspicious activity, validates potential threats, and initiates response actions in accordance with established procedures.
- Investigates and responds to security incidents and user-reported concerns, including phishing attempts, malware activity, unauthorized access attempts, policy violations, and other cybersecurity events.
- Performs initial analysis to determine scope, impact, and appropriate response.
- Executes incident response playbooks, runbooks, and standard operating procedures (SOPs) to perform alert triage, containment, documentation, and resolution activities for routine security incidents while maintaining established service levels.
- Escalates complex or high-risk incidents to Tier 2 analysts and appropriate technical teams, providing detailed documentation, investigative findings, and relevant context to support efficient incident resolution.
- Maintains accurate and comprehensive incident records, including alerts, investigative actions, containment measures, and resolution details.
- Ensures timely and effective communication of security events, operational updates, and shift handoff information to support continuous 24x7 monitoring operations.
- Provides after-hours operational support for Network Operations Center (NOC) activities, including monitoring network health, responding to basic network alerts, performing initial troubleshooting, and escalating infrastructure-related issues in accordance with established procedures.
- Contributes to the continuous improvement of SOC operations by assisting with the development and maintenance of incident response documentation, knowledge articles, operational procedures, and lessons learned from security events.
- Domestic U.S. travel is required.
QUALIFICATIONS:
- Graduate from an accredited college or university with an Associate's degree in a technical or related field is required.
- One year of experience is required.
- Additional work experience may be substituted for the educational requirement on a year-for-year basis.
- Additional education may be substituted for the educational requirement on a year-for-year basis.
- Experience in SOC/NOC support or a similar role is preferred, along with CompTIA Security+ certification or a similar certification.
- Experience with security monitoring tools, such as Defender or CrowdStrike, alerting and ticketing systems, SIEM platforms, and incident management tools is preferred.
- Experience with network monitoring tools, such as SolarWinds or ThousandEyes, and ticketing systems is also preferred.
- Must demonstrate knowledge of cybersecurity operations, including security alert monitoring, phishing and malware response, account or access-related anomalies, vulnerability indicators, incident documentation, escalation procedures, and the use of security tools such as SIEM platforms, endpoint detection tools, firewalls, antivirus solutions, and ticketing systems.
- Must possess a basic understanding of network support concepts sufficient to assist with after-hours NOC coverage, including TCP/IP fundamentals, DNS, DHCP, VPN connectivity, basic device or circuit outage awareness, connectivity troubleshooting, network monitoring alerts, and timely escalation to appropriate network support resources.
- Must be available and willing to work rotating shifts, including nights, weekends, and holidays.
- Proficiency in Microsoft Office applications is required.
CoreCivic is a Drug Free Workplace & EOE – Vets/Disabled.
