Information Security Analyst (Remote - LATAM)

Monitor security alerts and incidents in Microsoft Sentinel, Defender XDR, and Defender for Cloud

Triage incoming alerts to determine severity, impact, and required response actions

Differentiate between false positives, benign activity, and actionable threats using established playbooks

Perform continuous monitoring of cloud, identity, endpoint, and network telemetry

Investigate suspicious activity across Azure, Entra ID, Microsoft Defender XDR, and integrated data sources

Correlate logs, events, and indicators to establish timelines and determine root cause

Escalate confirmed or high-risk incidents to senior analysts or incident response teams

Execute or recommend containment actions in accordance with defined procedures

Utilize Kusto Query Language (KQL) and Log Analytics to analyze security data

Correlate events across identity, endpoint, network, and cloud workloads

Identify trends, anomalies, and patterns indicative of malicious activity

Provide input into detection tuning and rule optimization efforts

Create and maintain detailed, audit-defensible investigation notes and case records

Document all triage decisions, escalation rationale, and response actions

Produce incident summaries and reporting for internal stakeholders and clients

Participate in shift handoffs and maintain continuity of ongoing investigations

Stay informed on emerging threats, vulnerabilities, and attack techniques

Apply threat intelligence to contextualize alerts and improve detection accuracy

Participate in post-incident reviews and contribute to process improvements

Support tuning efforts to reduce false positives and improve detection fidelity

Work within a multi-tenant MSSP environment supporting multiple client environments

Collaborate with engineering, incident response, and client-facing teams

Provide clear and professional communication during incident escalations

Support service delivery objectives, SLOs, and operational metrics