Security Operations Analyst I (4 Days Onsite- Brentwood, TN- No Relocation Package)

At CoreCivic, our employees are driven by a deep sense of service, high standards of professionalism and a responsibility to better the public good. CoreCivic is currently seeking a Security Operations Analyst I located at our corporate office in Brentwood, TN. Come join a team that is dedicated to making an impact for the people and communities we serve.

This position would require a working 4 days (Mon-Thurs) onsite in Brentwood, TN.

SUMMARY:
The Security Operations Center (SOC) Analyst I serves as the front line of the organization's cybersecurity defense program, providing continuous monitoring, initial threat detection, alert triage, and incident response support in a 24x7 operational environment. Investigates security events, validates potential threats, executes established response procedures, and escalates complex incidents to higher-tier analysts. Works closely with users, IT teams, and security personnel to protect enterprise systems, minimize risk, and ensure timely resolution of security-related issues.

ESSENTIAL FUNCTIONS:
The incumbent should be able to perform all of the following functions at a pace and level of performance consistent with the job performance requirements.

• Monitors, analyzes, and triages security events and alerts generated by security technologies, including SIEM, endpoint protection platforms, firewalls, IDS/IPS, email security solutions, and other detection tools. Identifies suspicious activity, validates potential threats, and initiates response actions in accordance with established procedures.
• Investigates and responds to security incidents and user-reported concerns, including phishing attempts, malware activity, unauthorized access attempts, policy violations, and other cybersecurity events.
• Performs initial analysis to determine scope, impact, and appropriate response.
• Executes incident response playbooks, runbooks, and standard operating procedures (SOPs) to perform alert triage, containment, documentation, and resolution activities for routine security incidents while maintaining established service levels.
• Escalates complex or high-risk incidents to Tier 2 analysts and appropriate technical teams, providing detailed documentation, investigative findings, and relevant context to support efficient incident resolution.
• Maintains accurate and comprehensive incident records, including alerts, investigative actions, containment measures, and resolution details.
• Ensures timely and effective communication of security events, operational updates, and shift handoff information to support continuous 24x7 monitoring operations.
• Provides after-hours operational support for Network Operations Center (NOC) activities, including monitoring network health, responding to basic network alerts, performing initial troubleshooting, and escalating infrastructure-related issues in accordance with established procedures.
• Contributes to the continuous improvement of SOC operations by assisting with the development and maintenance of incident response documentation, knowledge articles, operational procedures, and lessons learned from security events.
• Domestic U.S. travel is required.

QUALIFICATIONS

• Graduate from an accredited college or university with an Associate's degree in a technical or related field is required.
• One year of experience is required.
• Additional work experience may be substituted for the educational requirement on a year-for-year basis.
• Additional education may be substituted for the educational requirement on a year-for-year basis.
• Experience in SOC/NOC support or a similar role is preferred, along with CompTIA Security+ certification or a similar certification.
• Experience with security monitoring tools, such as Defender or CrowdStrike, alerting and ticketing systems, SIEM platforms, and incident management tools is preferred.
• Experience with network monitoring tools, such as SolarWinds or ThousandEyes, and ticketing systems is also preferred.
• Must demonstrate knowledge of cybersecurity operations, including security alert monitoring, phishing and malware response, account or access-related anomalies, vulnerability indicators, incident documentation, escalation procedures, and the use of security tools such as SIEM platforms, endpoint detection tools, firewalls, antivirus solutions, and ticketing systems.
• Must possess a basic understanding of network support concepts sufficient to assist with after-hours NOC coverage, including TCP/IP fundamentals, DNS, DHCP, VPN connectivity, basic device or circuit outage awareness, connectivity troubleshooting, network monitoring alerts, and timely escalation to appropriate network support resources.
• Must be available and willing to work rotating shifts, including nights, weekends, and holidays.
• Proficiency in Microsoft Office applications is required.

CoreCivic is a Drug Free Workplace & EOE – Vets/Disabled.