Senior Security Analyst

Brown & Brown is seeking a Senior Security Analyst to join our growing team in Daytona Beach, FL or Plano, TX.

The Security Analyst supports the organization’s security posture through continuous monitoring, analysis, investigation, and response to cybersecurity threats and suspicious activity. This position within the Office of the CISO focuses on security operations, threat intelligence, incident triage, alert validation, log analysis, and coordination across security and technology teams to improve detection and response capabilities. The Security Analyst reports directly to the Global Director of Security Operations and Incident Response and helps the organization prevent, detect, contain, and respond to threats through disciplined analysis, documentation, and operational support. In addition, the security analyst is responsible for various security improvement projects.

How You Will Contribute:

• Monitor security alerts, events, and logs across endpoint, network, cloud, identity, email, and application security platforms

• Perform security triage, analysis, and investigation of suspicious activity to determine scope, impact, and appropriate response actions

• Validate and escalate security incidents in accordance with incident response procedures, ensuring timely communication and documentation

• Analyze data from SIEM, EDR, IDS/IPS, DLP, email security, and other monitoring tools to identify malicious or anomalous behavior

• Support incident response activities by collecting forensic evidence, preserving artifacts, analyzing forensic artifacts, tracking actions, and assisting with containment and recovery efforts

• Leverage threat intelligence sources and internal context to assess emerging threats, attacker tactics, and indicators of compromise relevant to the organization

• Review and tune detection content, use cases, and alert logic in partnership with engineering and platform teams to improve detection quality and reduce false positives

• Conduct recurring and ad hoc threat hunting activities using logs, endpoint telemetry, and threat intelligence to identify previously undetected threats

• Track, document, and report security incidents, investigative findings, trends, and operational metrics to support management reporting and continuous improvement

• Assist with vulnerability, exposure, and risk-related analysis by correlating findings with threat activity and business impact

Skills & Experience to be Successful:

• B.S. in Information Security, Computer Science, Computer Engineering or similar technical program or equivalent experience

• At least one active security certification preferred: GCIH, GCIA, CISSP, CEH or related

• Preferred experience using CrowdStrike, Google SecOps, Microsoft Log Analytics, and ServiceNow.

• 7+ years in a security operations, incident response, threat monitoring, or cyber defense role supporting a large organization

• Working knowledge of security monitoring and investigative technologies such as SIEM, EDR, IDS/IPS, DLP, vulnerability management, email security, and threat intelligence platforms

• Strong understanding of security operations concepts such as incident triage, alert validation, threat intelligence, kill-chain analysis, insider threat, risk assessment, and security metrics

• Familiarity with attack paths, threat vectors, attacker TTPs, indicators of compromise, and investigative methodologies

• Working knowledge of information security best practices, incident handling procedures, and common security frameworks such as NIST and MITRE ATT&CK

• Experience investigating activity in Microsoft security ecosystems, including Entra ID, Defender, and related cloud or hybrid environments preferred

• Experience with writing queries, analyzing logs, building reports, or using basic scripting for investigations and operational efficiency preferred