Cybersecurity Analyst I

Job Description
The Cybersecurity Analyst I (Tier 1 SOC Analyst) is responsible for monitoring, triaging, and responding to security alerts across enterprise environments. This role serves as the first line of defense within the SOC, supporting incident detection, initial investigation, and escalation while maintaining high-quality documentation and response standards.
The analyst will work with SIEM, EDR, and cloud security tools to identify potential threats, reduce false positives, and support the organization’s overall cybersecurity posture.
Key Responsibilities

• Monitor security alerts using tools such as Microsoft Sentinel, Splunk, and Microsoft Defender for Endpoint
• Perform initial triage and analysis of alerts (phishing, malware, suspicious login activity, endpoint detections)
• Investigate alerts using endpoint, network, and cloud logs
• Escalate confirmed or complex incidents to Tier 2/3 teams
• Create and update incident tickets in ServiceNow or similar platforms
• Follow incident response procedures aligned with NIST SP 800-61
• Document findings, actions taken, and outcomes clearly and accurately
• Support detection tuning by identifying false positives and recurring alert patterns
• Participate in shift handoffs and maintain situational awareness of ongoing incidents

Responsibilities
Key Responsibilities

• Lead the analysis, design, and implementation of business systems
• Gather and document business requirements from stakeholders
• Collaborate with crossfunctional teams to develop technology solutions
• Perform system testing and ensure quality assurance
• Provide technical guidance and support to the team

Qualifications
YOU MUST HAVE

• 0–2 years of experience in cybersecurity, IT, or SOC environment
• Basic understanding of:

• Networking (TCP/IP, DNS, HTTP/S)
• Operating systems (Windows/Linux)
• Security concepts (authentication, MFA, least privilege)

• Familiarity with SIEM or EDR tools
• Strong analytical and problem-solving skills
• Ability to follow structured processes and document clearly

WE VALUE
- Bachelor’s degree in Cybersecurity, IT, or related field (or equivalent experience)
- CompTIA Security+ certification
- Certified in Cybersecurity (CC)
- Experience with:

• Microsoft Defender for Endpoint
• Microsoft Sentinel

- Knowledge of MITRE ATT&CK framework
- Exposure to cloud environments (Azure/AWS)
- Basic scripting (PowerShell or Python)
- Experience handling tickets in ServiceNow
- Triage 20–40 alerts per shift
Maintain MTTR within defined SLA (e.g., <30 minutes for initial triage)- Achieve high-quality ticket documentation (audit-ready)
- Maintain low false escalation rate
- Contribute to alert tuning and continuous improvement
- 24/7 SOC coverage (rotating shifts, weekends, holidays as needed)
- Participation in on-call rotation (if applicable)
- Strong communication (written and verbal)
- Ability to work under pressure in a fast-paced environment
- Team collaboration and accountability
- Attention to detail
In addition to a competitive salary, leading-edge work, and developing solutions side-by-side with dedicated experts in their fields, Honeywell employees are eligible for a comprehensive benefits package. This package includes employer subsidized Medical, Dental, Vision, and Life Insurance; Short-Term and Long-Term Disability; 401(k) match, Flexible Spending Accounts, Health Savings Accounts, EAP, and Educational Assistance; Parental Leave, Paid Time Off (for vacation, personal business, sick time, and parental leave), and 12 Paid Holidays .For more Honeywell Benefits information visit: https://benefits.honeywell.com/
The annual base salary range for this position in California and New York (excluding most major metropolitan areas), Colorado, Connecticut, and Hawaii is $96,800 - 120,900. For Washington and most major metropolitan areas in New York & California, the annual base salary range is $96,800 - $120,900. Please note that this salary information serves as a general guideline. Honeywell considers various factors when extending an offer, including but not limited to the scope and responsibilities of the position, the candidate's work experience, education and training, key skills, as well as market and business considerations.
The application period for the job is estimated to be 40 days from the job posting date; however, this may be shortened or extended depending on business needs and the availability of qualified candidates. Job Posting Date: 4/21/2026
Due to compliance with U.S. export control laws and regulations, candidate must be a U.S. Person, which is defined as, a U.S. citizen, a U.S. permanent resident, or have protected status in the U.S. under asylum or refugee status or have the ability to obtain an export authorization.