Security Administrator I

The Security Administrator supports daily security monitoring, alert triage, and evidence collection to protect Church Mutual’s systems and data. This role executes defined operational tasks, follows runbooks, and develops foundational technical skills essential for cybersecurity operations. This role requires foundational hands-on technical proficiency in core security tools and concepts. Individuals without demonstrated technical capability will not meet expectations at this level.

PRIMARY JOB RESPONSIBILITIES:

• Assist in investigating and reporting detected cyber incidents by following established procedures, under close supervision and with frequent guidance.
• Support system cybersecurity monitoring operations by performing routine checks and escalating issues to senior team members as directed.
• Participate in basic cyber incident triage to help determine scope and urgency, always working with guidance from experienced analysts.
• Identify obvious vulnerabilities using provided tools and checklists, and report findings to senior staff for further action.
• Use computer network defense (CND) tools (such as IDS alerts, firewall logs, and host system logs) to collect data as instructed, without independent analysis.
• Document incident activities by completing standard forms and logs, ensuring all entries are reviewed by a supervisor.
• Contribute to root cause analysis by gathering information and assisting senior analysts, rather than conducting independent investigations.
• Stay informed about cybersecurity threats and best practices through assigned training and regular team briefings.
• Help maintain the Security Technology stack by performing basic tasks as assigned and under supervision.
• Respond to active attacks in cloud and on-premises environments by following detailed instructions from senior team members.
• Provide input on threat protection practices by sharing observations with the team, rather than making recommendations.
• Report suspected violations of organizational policies to supervisors for further review.
• Support risk mitigation efforts by carrying out exposure management tasks as directed.
• Participate in the development of enterprise-wide security architectures and standards by attending meetings and documenting discussions, not by designing solutions.
• Assist with baseline and risk assessments by collecting data and completing checklists under supervision.
• Provide basic cybersecurity consultation and participate in enterprise-wide health checks as part of a team, with guidance.
• Research cybersecurity threats as assigned and assist in responding to incidents by gathering information.
• Help maintain the enterprise cybersecurity risk register by entering data as directed.
• Assist with cybersecurity investigations and forensic activities by performing basic data collection and documentation.
• Support management of intrusion prevention systems and help define endpoint protection policies by executing routine tasks.
• Triage advanced threat detection (ATD) alerts by following predefined rules and escalating anything unusual.
• Provide basic advice and assistance to staff on cybersecurity matters, always referring complex questions to senior analysts.
• Participate in training sessions and stay updated on cybersecurity and communication technologies as part of ongoing development.
• Level Expectations (Performance and Scope Indicators)

The following outlines how performance is evaluated at this level. These are not additional job responsibilities, but indicators of scope, autonomy, impact, and influence expected of this role.

Scope: Executes clearly defined cybersecurity tasks related to monitoring, alert triage, and data collection. Contributes to incident response, vulnerability management, and security operations under close guidance.

Autonomy: Operates with frequent supervision. Follows documented runbooks. Escalates issues consistently. Expected to develop foundational technical skills but not yet independently solve complex problems.

Impact: Supports the accuracy, speed, and consistency of core security operations. Ensures reliable first-level triage and data gathering that downstream engineers rely on.

People Influence: No formal influence responsibilities. Collaborates as part of the team. May provide peer support but does not mentor.

QUALIFICATIONS:

Required

• Foundational technical fluency in cybersecurity concepts and tools.
• Ability to interpret basic SIEM/NDR/EDR alerts.
• Understanding of TCP/IP, DNS, DHCP, identity basics, and endpoint behavior.
• Ability to execute documented runbooks accurately.
• Strong attention to detail and documentation quality.
• Degree in CS/IS/Cybersecurity or equivalent experience/training.

Technical Competencies

• Ability to extract data from basic logs.
• Familiarity with Defender, Sentinel, or similar tooling.
• Ability to recognize anomalous behavior and escalate appropriately.

Preferred

• Security+ or SC-200 coursework/certification.
• Experience in SOC, IT support, or network operations.

Exact compensation will vary based on consideration of a variety of factors including education, skills, experience, and location