Company Overview

Preferred Business Systems has been serving the office automation and IT support needs of the regional business community since 1997. We pride ourselves on delivering high-quality service, innovative solutions, and comprehensive cybersecurity support to ensure our clients’ operational efficiency and security.

Position Summary

We are seeking a Cybersecurity Technician II to serve as the escalation point for security monitoring across our client base. When an alert needs more than a playbook response, it comes to you. This is the role our day-to-day security operations escalate into, and the person in it sets the standard for how thoroughly we investigate.

You will investigate alerts that require real analysis, drive incidents through containment and resolution, and oversee vulnerability management across assigned clients. You will also need a working grasp of the security platforms we run — what each one is actually for, what it covers, and where its limits are — because that judgment is what separates a good escalation from a guess.

Over time, you will take on more of the project side of the practice: scoping hardening work, helping evaluate platforms, and working with the Cybersecurity Manager on how to deploy controls across a client base. We expect you to grow into that rather than arrive with it. The Cybersecurity Manager continues to own client compliance engagements and audit relationships.

Security Monitoring and Escalation 

• Serve as the first escalation point for security alerts across all client environments, including critical alerts outside standard business hours.

• Investigate alerts that go beyond established playbooks, and determine whether something is a false positive, a misconfiguration, or a genuine threat.

• Perform log and endpoint analysis to establish scope and identify indicators of compromise (IoCs).

• Tune detection rules and alert thresholds to cut noise without losing coverage.

• Take escalations from the Technician I, review their findings, and show your reasoning so they learn from it.

• Track emerging threats and translate them into practical monitoring and configuration changes.

Incident Response

• Drive security incidents through investigation, containment, and resolution.

• Coordinate with the SOC and client IT contacts during active incidents.

• Escalate high-severity events to the Cybersecurity Manager with a clear picture of scope and impact.

• Document incident timelines, actions taken, and technical findings in a form that holds up to client and auditor review.

Vulnerability Management

• Oversee vulnerability scanning across assigned client environments.

• Prioritize findings by real-world risk rather than raw scanner severity.

• Develop remediation plans and drive them to completion with client and internal teams.

• Report on remediation progress and residual risk.

Security Platform Knowledge

• Maintain working knowledge of the platforms we run — endpoint protection and EDR, SIEM, email security, identity and MFA, patch management, and backup.

• Understand what each platform genuinely covers and where its blind spots are, so escalation decisions rest on more than the alert text.

• Verify that deployed controls are configured and functioning as intended, and flag gaps.

• Provide the Cybersecurity Manager with practical feedback on how our tooling performs in real client environments.

Project Work (developing over time)

• Support security hardening and platform deployment projects across client environments.

• Contribute to scoping discussions — what a rollout would take, what it would break, and which clients it suits.

• Work with the Cybersecurity Manager to build and refine deployment plans, taking on more ownership as you develop.

• Help maintain hardening standards and baseline configurations.

• Support security implementation during new client onboarding.

Compliance Support

• Implement and verify the technical controls required by frameworks such as HIPAA and PCI-DSS.

• Provide technical evidence and configuration documentation to support audits.

• Flag technical compliance gaps to the Cybersecurity Manager, who owns the client and auditor relationship.

Collaboration and Team Development

• Coordinate with networking, helpdesk, and systems teams to keep security consistent across environments.

• Mentor the Technician I, review their work, and support their certification progress.

• Write and maintain playbooks, runbooks, and internal security documentation.

• Participate in client-facing technical discussions alongside the Cybersecurity Manager.

Job Requirements

Required — Experience

• Minimum 3 years in IT, with at least 2 years focused on security work.

• Substantial hands-on time investigating security alerts — not just acknowledging them, but working them to a conclusion.

• Daily operating experience with SIEM and endpoint protection or EDR platforms.

• Experience with vulnerability scanning tools and remediation follow-through.

• Experience administering or securing firewalls and VPNs.

• Some exposure to deploying or configuring security tooling, even if you have not owned a rollout end to end.

Required — Certifications or Education

• CompTIA Security+ and/or Network+, or an equivalent certification.

• Relevant formal education or coursework in cybersecurity, information technology, or a related field is accepted in place of certification.

Required — Technical Knowledge

• Working familiarity with the major categories of security tooling and a practical sense of what each one covers and does not cover.

• Solid grasp of networking fundamentals: TCP/IP, DNS, segmentation, firewalls, VPNs.

• Working knowledge of Windows administration and Active Directory; general familiarity with Linux and macOS.

• Understanding of core security principles: encryption, authentication, identity management, and risk.

• Familiarity with system hardening concepts and baseline frameworks such as CIS Benchmarks.

• Awareness of the technical control requirements behind HIPAA, PCI-DSS, and similar frameworks.

Required — Professional Skills

• Sound judgment under time pressure, and the discipline to escalate rather than improvise when a situation exceeds your authority.

• Strong written documentation habits — incident notes and findings others can act on.

• Ability to explain a technical finding and its real risk without jargon or alarmism.

• Ability to prioritize across multiple client environments with competing urgency.

• Interest in growing into project and deployment work, and the patience to learn it properly.

• Availability to respond to critical security alerts outside of standard business hours.

• Reliable on-site attendance during standard business hours.

Preferred

• Prior experience at a Managed Service Provider (MSP) or MSSP.

• Experience securing Microsoft 365 and Azure environments; AWS exposure also valuable.

• Experience assisting with security tooling rollouts across multiple sites or clients.

• Additional certifications such as CompTIA CySA+, GSEC, or vendor certifications on platforms we run.

• Experience mentoring or training junior technical staff.

• Experience supporting clients in healthcare, financial services, or other regulated industries.