Security Analyst

Johnson Controls, a global leader in thermal management, mission-critical building systems, energy efficiency, and decarbonization, helps customers use energy more productively, reduce carbon emissions, and operate with the precision and resilience required in rapidly expanding industries such as data centers, healthcare, pharmaceuticals, advanced manufacturing, and higher education.
For more than 140 years, Johnson Controls has delivered performance where it really matters. Backed by advanced technology, lifecycle services and an industry-leading field organization, we elevate customer performance, turn goals into real-world results and help move society forward.
What We Offer
Competitive salary
Paid vacation/holidays/sick time
Comprehensive benefits package including 401K, medical, dental, and vision care
On the job/cross training opportunities
Encouraging and collaborative team environment
Dedication to safety through our Zero Harm policy
What You Will Do
Investigate and respond to security alerts and incidents, performing root cause analysis and driving corrective actions.
Lead and support incident response efforts, coordinating across teams to contain and remediate threats.
Continuously improve detection and response processes through automation, runbook development, and SOP creation.
Identify and strengthen threat detection and prevention capabilities.
Integrate threat intelligence into operational workflows to proactively address emerging threats.
Collaborate with Security, IT, and Business teams to enhance readiness and resilience through joint response planning.
What You’ll Need To Succeed
Extensive experience in Security Operations and Incident Response, with a strong track record of handling complex incidents.
Proficiency with modern cybersecurity tools (EDR, SIEM, firewalls, WAF, identity, and cloud security platforms).
Experience operationalizing threat intelligence and developing detection strategies for evolving threats.
Strong analytical and problem-solving skills, with a focus on process rigor and continuous improvement.
Ability to drive action and influence outcomes in fast-paced, cross-functional environments.
Excellent communication and collaboration skills, with a team-first mindset and mentoring capabilities.
Required
What we look for:
1–5 years in a SOC, incident response, IT security operations, or adjacent role (e.g., EDR admin, blue team intern/co-op).
Experience with at least one of: SIEM, EDR/XDR, secure email gateway, cloud security tools (M365 Defender suite, Defender for Endpoint, Sentinel, Splunk, CrowdStrike, Palo Alto, Zscaler, etc.).
Familiarity with core investigation concepts: event correlation, user/host baselining, MITRE ATT&CK, common malware/TTPs, phishing indicators.
Strong communication skills—able to explain technical issues to non-technical users and document clearly and concisely.
Understanding of basic networking (TCP/IP, DNS, HTTP, VPN) and Windows/Linux fundamentals (processes, services, logs, registry, authentication).
Ability to work in a ticket-driven environment with SLAs and handoffs to an MSSP.
Inquisitive personality that lends itself to question asking and research
Preferred
Exposure to manufacturing/OT environments (ICS/SCADA basics, Purdue model, segmentation concepts, remote access risks).
Experience enriching investigations with OSINT Tools (VirusTotal, Shodan, Censys, CyberChef etc.)
Experience with SOAR workflows and playbooks; basic scripting (PowerShell, Python, KQL) for triage automation.
Knowledge of identity security (AAD, MFA, conditional access), email security, and cloud log sources.
Certifications: Security+, CySA+, Microsoft SC‑200, GSEC, or equivalent.

Work arrangement
No