IT Security Administrator

Title:

IT Security Administrator

KBR’s Sustainable Technology Solutions (STS) group is looking for a Completions Database Specialist to support the multi-billion-dollar Plaquemines project developing a Liquid Natural Gas export facility when fully developed will have an export capacity of up to 20 million metric tonnes per year. 

The SOC Incident Responder is responsible for identifying, investigating, containing, and responding to cybersecurity incidents affecting the organization's systems, networks, cloud environments, and users. This role serves as a key member of the Security Operations Center, performing rapid incident triage, threat analysis, containment actions, and escalation of significant security events. The successful candidate will combine technical cybersecurity expertise with strong analytical, communication, and documentation skills to minimize risk and ensure timely response to cybersecurity threats.

Responsibilities:

Incident Detection & Response

• Monitor and investigate security alerts from Taegis, Defender as well as user or third-party reported incidents.
• Perform initial triage and analysis of suspicious events and potential security incidents.
• Determine incident severity, scope, and business impact.
• Contain security incidents through actions such as:
  • Account disablement
  • Password resets
  • Session revocation
  • Device isolation
  • IP and domain blocking
• Escalate complex or high-severity incidents to senior security personnel.

Investigation & Analysis

• Analyze endpoint, network, identity, and cloud telemetry.
• Correlate indicators of compromise (IOCs) with threat intelligence sources.
• Identify root causes and attack vectors.
• Conduct malware investigations and support forensic analysis activities.
• Track attacker tactics, techniques, and procedures (TTPs) using frameworks such as MITRE ATT&CK.

Incident Documentation

• Maintain detailed incident records and case documentation.
• Create incident reports detailing findings, actions taken, and business impact.
• Ensure evidence is collected, preserved, and documented appropriately.
• Participate in post-incident reviews and lessons-learned sessions.

Collaboration

• Coordinate with IT Operations, Service Desk, Infrastructure, Network, and Cloud teams during investigations.
• Communicate incident status to stakeholders and management.
• Support major incident response activities and virtual war room operations during significant security events.

Continuous Improvement

• Contribute to development of SOC playbooks and response procedures.
• Recommend improvements to detection rules, monitoring coverage, and response workflows.
• Assist in threat hunting and security control validation activities.
• Stay current with emerging threats, vulnerabilities, and industry best practices.

Required Qualifications, Education & Experience:

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or equivalent experience.
• 2–5+ years of cybersecurity, SOC, incident response, or security operations experience.
• Experience investigating security incidents in enterprise environments.
• Familiarity with Windows, Linux, cloud platforms, and enterprise networking.
• SIEM technologies
• EDR/XDR platforms (Taegis , Microsoft Defender, CrowdStrike, SentinelOne, etc.)
• Email security technologies
• Identity platforms such as Active Directory and Entra ID
• Network protocols and traffic analysis
• Threat intelligence and IOC analysis
• Incident response methodologies and frameworks
• BPSS, SC Eligible or Existing SC Preferred
• GCIH (GIAC Certified Incident Handler)
• GCIA
• GCFA
• CISSP
• Security+
• CySA+
• SC-200 (Microsoft Security Operations Analyst)
• Analytical thinking
• Incident prioritization
• Problem solving
• Attention to detail
• Communication and teamwork
• Ability to work effectively under pressure
• Strong documentation skills
• Participation in a 24x7 SOC shift rotation and on-call coverage as required.
• Support for major cybersecurity incidents outside normal business hours.
• Ability to manage multiple concurrent security investigations.

Belong. Connect. Grow. with KBR!