Security Operations Analyst

"You'll be the first line of defense, turning raw alerts into real threat intelligence for a platform that keeps thousands of trucking and logistics fleets moving."

As a Security Operations Analyst on Mastery's Information Security team, you'll monitor, triage, and investigate security alerts across our enterprise and Azure-native infrastructure. You'll work alongside our Security Operations Engineer and Team Lead to protect MasterMind, our transportation management platform, and the infrastructure it runs on from threats and attackers—following established playbooks to contain and escalate real threats, and building the pattern-recognition instincts that come from doing this work every day.

This role is ideal for a curious, detail-oriented analyst who's already spent time in a SOC or similarly alert-driven environment and wants to keep sharpening their craft. You don't need to walk in knowing everything — but you should already know what it feels like to work a queue under pressure.

• Monitor and investigate: actively work security alerts across Microsoft Sentinel and Mastery's Azure environment, distinguishing real threats from noise.
• Follow the playbook: execute documented triage and escalation procedures, taking containment or remediation action when appropriate.
• Document clearly: write investigation notes that are clear and defensible enough for anyone on the team, an auditor, or a customer to follow.

• Recognize patterns: apply Cyber Kill Chain and MITRE ATT&CK concepts to identify what an alert is actually telling you.
• Escalate what matters: know when and how to hand off to the Security Operations Engineer or Team Lead, with the context they need to act fast.

• Support detection tuning: flag false positives, missed detections, and visibility gaps back to the team that builds and tunes the rules.
• Grow with the team: take on stretch assignments — basic scripting, log analysis, evidence collection — that build toward more senior SecOps work.

• 2+ years of experience in security operations, IT, or a related alert-driven, shift-based role — not a recent graduate, but not necessarily a career SOC veteran either.
• Familiarity with SIEM platforms (Microsoft Sentinel or comparable) from hands-on work or coursework.
• Working knowledge of MITRE ATT&CK and Cyber Kill Chain frameworks.

• Eager and coachable: genuinely wants to grow technically and takes feedback well.
• Clear communicator: can write and speak about technical findings in a way both teammates and non-technical stakeholders can follow.
• Even-keeled under pressure: stays methodical when the queue is full or an alert requires immediate action.

• Basic scripting exposure (Python or PowerShell).
• Security+, SC-200, or a comparable entry-level certification.
• Exposure to Azure or another major cloud platform.
• Experience with case management or ticketing tools (Jira or similar).

• Alerts are triaged accurately and fast: real threats are never missed, and false positives don't stand in the way of investigating what matters.
• Investigation notes stand on their own: any teammate, auditor, or the Team Lead can pick up exactly where you left off.
• You're building toward more: each quarter you're taking on more complex investigations and contributing real feedback to detection tuning.

Most TMS platforms are tolerated. We've proven a better way — one platform built for every facet of transportation: shippers, carriers, private fleets, and brokers, all under one roof. Built to be loved. We're still the only ones who mean that.