Description
We are seeking a Security Operations Center (SOC) Analyst to support the Pentagon Reservation under the DISA GSM-O II TN24 Penetration Handling, Incident, System Health (PHISH) Support Services II program.
The SOC Analyst will support a 24/7 SOC mission and requires availability for rotating shifts, including weekends, holidays, and inclement-weather operations.
The successful candidate will be responsible for:
- Monitoring, triaging, and investigating alerts from various security tools and sensors
- Analyzing endpoint, host, network, identity, application, and cloud telemetry to identify anomalous activity
- Conducting incident investigations and providing recommendations for containment, eradication, recovery, and post-incident activities
- Applying cyber threat intelligence and knowledge of adversary tactics, techniques, and procedures (TTPs) to validate alerts and identify indicators of compromise
- Supporting proactive threat hunts, environment sweeps, and detection-validation activities
- Identifying recurring false positives, control gaps, telemetry limitations, and recommending improvements to detection logic and SOC processes
- Contributing to the development, testing, tuning, and documentation of detection use cases, correlation logic, and analytic playbooks
- Documenting analytic methods, evidence, findings, actions taken, and recommended next steps
- Preparing clear incident tickets, shift summaries, and technical reports
- Collaborating with SOC operations, incident response, cyber engineering, threat intelligence, system administrators, and mission partners
- Providing technical guidance, peer review, and knowledge sharing to junior analysts
Requirements:
- Active DoD Top Secret clearance with ability to obtain SCI
- DoD 8570 IAT II or higher certification
- Bachelor's degree in cybersecurity, information technology, computer science, intelligence studies, or a related technical discipline
- 4-8 years of relevant experience
- Experience supporting a SOC, CND organization, cyber protection team, incident-response team, network operations center, or comparable cybersecurity operations environment
- Experience monitoring and investigating cybersecurity events using SIEM, EDR, IDS/IPS, endpoint, network, identity, cloud, vulnerability, and log-data sources
- Working knowledge of incident-response processes, TCP/IP, common ports and protocols, network traffic flow, endpoint and operating-system fundamentals, authentication and identity activity, and enterprise security controls
Preferred Qualifications:
- Experience using one or more enterprise SIEM platforms
- Experience with EDR, antivirus, host-based security tools, IDS/IPS, network detection and response, vulnerability-management tools, NetFlow, or packet-capture analysis
- Familiarity with Windows and Unix/Linux operating systems, command-line tools, and system-administration concepts
- Experience with structured threat hunting, detection tuning, use-case development, or translating threat intelligence into analytic queries