Security Operations Analyst at Plante Moran in Southfield, MI

Summary: Plante Moran is one of the nation’s largest audit, tax, consulting, and wealth management firms, known for its strong culture and commitment to diversity. The Security Operations Analyst supports day-to-day cybersecurity operations and helps mature the firm’s security program, providing hands-on experience across SOC processes, identity and access management, cloud security, and endpoint protection. Responsibilities: - Support Level 1 requests across SOC, IAM, and cloud security (e.g., software/blocked URL requests, DLP requests, client VPN/network app troubleshooting, and group/service account changes) - Investigate Tier 1 incidents (e.g., phishing reports, malware detections, failed authentications, and policy violations) and escalate as needed - Monitor, triage, and validate security alerts across multiple systems and platforms using established SOC procedures - Partner with incident responders during investigations and escalate to senior analysts or management as required - Create, update, and maintain incident tickets with clear documentation, evidence, and findings - Assist with maintaining and improving standard operating procedure (SOP) playbooks and security documentation - Document investigation outcomes and contribute to reports that help improve the organization’s security posture - Stay current on emerging threats, vulnerabilities, and security best practices - Collaborate with cybersecurity, IT, and internal teams to support security operations - Other duties as assigned Required Qualifications: - Bachelor's degree in Information Systems, Cybersecurity, Computer Science, or related field preferred; or 2–5 years of relevant experience - 1–3 years of experience or equivalent exposure (internships, military, or hands-on training) in one or more: SOC, incident response, IAM, or endpoint/network/application security - Exposure to one or more: SIEM; EDR/next-generation antivirus; email/phishing security; IAM solutions; vulnerability management or threat intelligence tools - Foundational understanding of security and networking concepts, including DNS, TCP/IP, SMTP, and HTTP - Familiarity with frameworks/standards such as NIST CSF, CIS Benchmarks, and MITRE ATT&CK - Basic understanding of malware distribution, technical risk, and containment/mitigation techniques - Knowledge of Microsoft security tools and practices is a plus - Experience with scripting or automation (e.g., Python, PowerShell) is a plus - Ability to prioritize and manage tasks based on intake queues and service level agreements (SLAs) - Strong written and verbal communication skills across varying levels of the organization - Demonstrated integrity, accountability, and pride in quality work - Curiosity, adaptability, and a strong desire to learn Required Skills: Security Operations Center (SOC), Identity, Access Management (IAM), Cloud Security, Endpoint Security, Incident Response, Security Information, Event Management (SIEM), Endpoint Detection, Response (EDR), Email/Phishing Security, Vulnerability Management, Threat Intelligence, Networking Concepts, NIST Cybersecurity Framework (CSF), CIS Benchmarks, MITRE ATT&CK Framework, Malware Analysis, Microsoft Security Tools, Scripting, Python, PowerShell, Curiosity, Desire to Learn Benefits: Health, dental, vision, disability, and life insurance, Flexible Time Off, Various pre-determined holidays, 401(k) plan, Flexible benefits plans, Business-related travel expense, Lodging, and meal reimbursement for business-related use, A pension plan is also available for eligible administrative and paraprofessional staff, A discretionary bonus plan is available for eligible staff, Plante Moran also offers some contingent staff positions the option to elect health insurance in addition to limited paid sick time