The Bancorp, Inc. Jobs Hiring Now

Work Arrangement:

***This position is available as a hybrid position in our Sioux Falls, SD or Wilmington, DE office.***

• Monitors security alerts from approved tools and performs initial triage using documented procedures and playbooks.
• Reviews relevant firewall, email, web, domain name system (DNS), endpoint, and other logs to gather evidence and identify indicators of suspicious activity.
• Creates and updates tickets, documents actions taken, and escalates incidents based on defined severity and escalation criteria.
• Supports incident response activities under guidance, including evidence collection, basic scoping, containment tracking, and follow-up documentation.
• Reviews threat intelligence alerts and indicators of compromise for relevance to the environment and escalates significant findings.
• Runs approved vulnerability scans and reviews results to identify potential issues, duplicates, and items requiring validation.
• Collects and reviews asset information, including configurations and running processes, to support investigations and vulnerability management.
• Operates security monitoring tools and performs routine configuration or tuning tasks under guidance.
• Participates in change management activities and follows established security operations procedures.
• Communicates technical findings clearly to cybersecurity team members, internal partners, and vendors.
• Assists with security product evaluations and recommends improvements based on documented requirements.
• Supports security metrics, trend reporting, and assigned security awareness activities.
• Uses approved AI-assisted capabilities to enrich alerts, correlate indicators, summarize evidence, and support basic investigation tasks.
• Uses approved AI assistance to draft basic queries, investigation notes, reports, scripts, and stakeholder communications.
• Validates AI-generated content against authoritative sources and follows approved-use, data-handling, human-review, documentation, and auditability requirements.
• Maintains awareness of emerging threats, including AI-enabled phishing, social engineering, and enterprise AI misuse, and escalates relevant findings.
• Performs other duties as assigned.

• Associate or bachelor’s degree in cybersecurity, information technology, computer science, or a related field, or an equivalent combination of education, training, and experience.
• Internships, academic labs, help desk, system administration, network support, or security operations experience may qualify as relevant experience.
• Foundational understanding of cybersecurity principles, common threats, Transmission Control Protocol/Internet Protocol (TCP/IP) networking, and Windows, Linux, or macOS operating systems.
• Basic familiarity with security logs, monitoring tools, vulnerability management concepts, and ticketing workflows.
• Ability to follow documented procedures, maintain accurate records, recognize when additional assistance is needed, and escalate promptly.
• Basic scripting, command-line, or query skills, or a demonstrated willingness to learn tools such as Python, PowerShell, or SQL.
• Familiarity with generative AI and machine learning concepts used in cybersecurity, including common capabilities, limitations, privacy risks, and the need for human validation.
• Clear written and verbal communication, sound organization, and the ability to work effectively in a collaborative environment.
• Coursework, an internship, a lab environment, or hands-on experience related to security operations, threat analysis, incident response, or vulnerability management preferred.
• Familiarity with one or more security technologies, such as security information and event management (SIEM), endpoint or extended detection and response (EDR/XDR), security orchestration, automation, and response (SOAR), threat intelligence, vulnerability scanning, or ticketing platforms preferred.
• Basic knowledge of network traffic, firewalls, intrusion detection or prevention, packet analysis, cloud services, databases, or data visualization tools preferred.
• An entry-level certification, such as CompTIA Security+, Network+, CySA+, Microsoft SC-900, or a comparable vendor credential, or a willingness to pursue one preferred.
• Basic experience with scripting, application programming interfaces (APIs), or low-code automation to collect, organize, or validate security data preferred.
• Familiarity with approved AI-assisted workflows for security research, documentation, query development, or analysis preferred.
• Awareness of AI-specific security risks and safeguards, including prompt injection, sensitive-data leakage, malicious automation, and AI-generated social engineering preferred.

• Within the first 90 days, works the alert queue independently using established playbooks.
• Documents investigations clearly enough that a senior analyst can pick up the case without a conversation.
• Escalates at the right threshold, neither sitting on something urgent nor passing up work the analyst is equipped to handle.
• By the end of the first year, has progressed meaningfully toward a foundational security certification.
• Navigates the SIEM and endpoint tooling without supervision.
• Contributes to tuning suggestions and threat hunting work rather than only consuming assignments.
• Treats AI-assisted output as a draft rather than an answer, and consistently validates results against primary evidence before acting.

• This position is the program’s intake layer.
• Alerts, threat intelligence feeds, scan output, and asset discovery data all land here first, and anything missed or under-documented at this stage does not get caught somewhere else.
• This position protects senior capacity.
• Detection engineering, forensics, and threat hunting require uninterrupted focus, which is impossible while working a live queue.
• Level 1 ownership of steady-state triage is what lets senior analysts go deep, and it is why routine monitoring and ticket flow keep running when responders pull away to an active incident.
• This position closes the feedback loop.
• No one sees false positives more often than the analyst in the queue daily, and those observations are the raw input for tool tuning.
• The same applies to the vulnerability and asset data reviewed here, which keeps the program’s picture of its own environment accurate.
• This position creates the record.
• Good case documentation makes work transferable across shifts and up to incident response, while thin documentation means the work gets redone.
• This position is where AI governance actually happens.
• Approved-use and human-review requirements are policy on paper until someone applies them at the point of use, and the highest-volume routine AI usage in the department sits in this seat.
• This position is the program’s bench, developing future senior analysts on the Bank’s own tooling and escalation thresholds.