Cyber Threat Analyst - Global Threat Operations

About the role

LevelBlue is seeking a Cyber Threat Analyst to join its Global Threat Operations (GTO) team within Managed Security Services. The analyst will work US dayshift (Tuesday‑Saturday) and will interact with customers and partners using professional etiquette while delivering security monitoring and response services.

Key responsibilities

• Perform network analysis using strong TCP/IP networking skills to understand detected threats.
• Analyze and respond to security events from firewalls, IDS, IPS, SIEM, Web Application Firewall (WAF) and other data sources within documented SLA.
• Respond to customer tickets and incident notifications within SLA standards.
• Tune security devices for blocking and reporting based on customer business needs.
• Communicate effectively with customers and internal resources in a polite, positive, and professional manner.
• Ensure customer satisfaction and the overall success of managed services.
• Adhere to policies, procedures, and security best practices while handling escalations appropriately.

Required profile

• Basic proficiency in information security best practices, network security architecture, and current cyber‑security events.
• Familiarity with Unix/Linux operating systems and TCP/IP networking.
• Knowledge of Sourcefire/Snort‑based security products, IP tables/packet‑filter firewalls, scanning technologies, and log collection/analysis tools.
• Experience in information security, web‑server administration, or networking is desired.
• Excellent customer service, analytical thinking, and strong oral and written communication skills.
• Self‑managed, team‑oriented, detail‑oriented, and highly motivated.
• Fluency in English; certifications such as GCIA, GCIH, Security+, OSCP, or CEH are preferred.
• High school diploma required; a college or university degree is a plus.

Required skills

• TCP/IP networking
• Unix/Linux operating systems
• Sourcefire/Snort security products
• IP tables / packet‑filter firewalls
• Scanning technologies
• Log collection and analysis tools
• SIEM platforms
• Firewalls, IDS, IPS, WAF