Cybersecurity Threat Analyst I

About the Role

This position is available as a hybrid position in our Sioux Falls, SD or Wilmington, DE office. At The Bancorp, we've spent more than 25 years driving innovation in the financial services industry. We provide the people, processes, technology, and banking capabilities that turn bold ideas into outcomes. Join a team that plays a direct role in driving growth for our clients and the communities we serve.

Key Responsibilities

• Monitors security alerts from approved tools and performs initial triage using documented procedures and playbooks.
• Reviews relevant firewall, email, web, DNS, endpoint, and other logs to gather evidence and identify indicators of suspicious activity.
• Creates and updates tickets, documents actions taken, and escalates incidents based on defined severity and escalation criteria.
• Supports incident response activities under guidance, including evidence collection, basic scoping, containment tracking, and follow-up documentation.
• Reviews threat intelligence alerts and indicators of compromise (IOCs) for relevance to the environment and escalates significant findings.
• Runs approved vulnerability scans and reviews results to identify potential issues, duplicates, and items requiring validation.
• Collects and reviews asset information, including configurations and running processes, to support investigations and vulnerability management.
• Operates security monitoring tools and performs routine configuration or tuning tasks under guidance.
• Participates in change management activities and follows established security operations procedures.
• Communicates technical findings clearly to cybersecurity team members, internal partners, and vendors.
• Assists with security product evaluations and recommends improvements based on documented requirements.
• Supports security metrics, trend reporting, and assigned security awareness activities.
• Uses approved AI-assisted capabilities to enrich alerts, correlate indicators, summarize evidence, and support basic investigation tasks.
• Uses approved AI assistance to draft basic queries, investigation notes, reports, scripts, and stakeholder communications.
• Validates AI-generated content against authoritative sources and follows approved-use, data-handling, human-review, documentation, and auditability requirements.
• Maintains awareness of emerging threats, including AI-enabled phishing, social engineering, and enterprise AI misuse, and escalates relevant findings.
• Performs other duties as assigned.

Requirements & Tech Stack

• Associate or bachelor’s degree in cybersecurity, information technology, computer science, or a related field, or an equivalent combination of education, training, and experience.
• Internships, academic labs, help desk, system administration, network support, or security operations experience may qualify as relevant experience.
• Foundational understanding of cybersecurity principles, common threats, TCP/IP networking, and Windows, Linux, or macOS operating systems.
• Basic familiarity with security logs, monitoring tools, vulnerability management concepts, and ticketing workflows.
• Ability to follow documented procedures, maintain accurate records, recognize when additional assistance is needed, and escalate promptly.
• Basic scripting, command-line, or query skills, or a demonstrated willingness to learn tools such as Python, PowerShell, or SQL.
• Familiarity with generative AI and machine learning concepts used in cybersecurity, including common capabilities, limitations, privacy risks, and the need for human validation.
• Clear written and verbal communication, sound organization, and the ability to work effectively in a collaborative environment.

Preferred Qualifications

• Coursework, an internship, a lab environment, or hands-on experience related to security operations, threat analysis, incident response, or vulnerability management.
• Familiarity with one or more security technologies, such as SIEM, EDR/XDR, SOAR, threat intelligence, vulnerability scanning, or ticketing platforms.
• Basic knowledge of network traffic, firewalls, intrusion detection or prevention, packet analysis, cloud services, databases, or data visualization tools.
• An entry-level certification, such as CompTIA Security+, Network+, CySA+, Microsoft SC-900, or a comparable vendor credential, or a willingness to pursue one.
• Basic experience with scripting, APIs, or low-code automation to collect, organize, or validate security data.
• Familiarity with approved AI-assisted workflows for security research, documentation, query development, or analysis.
• Awareness of AI-specific security risks and safeguards, including prompt injection, sensitive-data leakage, malicious automation, and AI-generated social engineering.