Security Operations Analyst I (4 Days Onsite- Brentwood, TN- No Relocation Package)

At CoreCivic, our employees are driven by a deep sense of service, high standards of professionalism and a responsibility to better the public good. CoreCivic is currently seeking a Security Operations Analyst I located at our corporate office in Brentwood, TN. Come join a team that is dedicated to making an impact for the people and communities we serve. This position would require a working 4 days (Mon-Thurs) onsite in Brentwood, TN.

SUMMARY:

The Security Operations Center (SOC) Analyst I serves as the front line of the organization's cybersecurity defense program, providing continuous monitoring, initial threat detection, alert triage, and incident response support in a 24x7 operational environment. Investigates security events, validates potential threats, executes established response procedures, and escalates complex incidents to higher-tier analysts. Works closely with users, IT teams, and security personnel to protect enterprise systems, minimize risk, and ensure timely resolution of security-related issues.

ESSENTIAL FUNCTIONS:

The incumbent should be able to perform all of the following functions at a pace and level of performance consistent with the job performance requirements.

• Monitors, analyzes, and triages security events and alerts generated by security technologies, including SIEM, endpoint protection platforms, firewalls, IDS/IPS, email security solutions, and other detection tools. Identifies suspicious activity, validates potential threats, and initiates response actions in accordance with established procedures.
• Investigates and responds to security incidents and user-reported concerns, including phishing attempts, malware activity, unauthorized access attempts, policy violations, and other cybersecurity events.
• Performs initial analysis to determine scope, impact, and appropriate response.
• Executes incident response playbooks, runbooks, and standard operating procedures (SOPs) to perform alert triage, containment, documentation, and resolution activities for routine security incidents while maintaining established service levels.
• Escalates complex or high-risk incidents to Tier 2 analysts and appropriate technical teams, providing detailed documentation, investigative findings, and relevant context to support efficient incident resolution.
• Maintains accurate and comprehensive incident records, including alerts, investigative actions, containment measures, and resolution details.
• Ensures timely and effective communication of security events, operational updates, and shift handoff information to support continuous 24x7 monitoring operations.
• Provides after-hours operational support for Network Operations Center (NOC) activities, including monitoring network health, responding to basic network alerts, performing initial troubleshooting, and escalating infrastructure-related issues in accordance with established procedures.
• Contributes to the continuous improvement of SOC operations by assisting with the development and maintenance of incident response documentation, knowledge articles, operational procedures, and lessons learned from security events.
• Domestic U.S. travel is required.