Senior Cybersecurity Operations Center Analyst

What you'll do

• Analyze real-time threats and use advanced tools to identify patterns and stop malicious actors.
• Lead a team of professionals to evaluate cybersecurity solution weaknesses and mitigation effectiveness.
• Manage the full incident lifecycle including triage, root cause investigation, containment, and remediation.
• Develop and refine standard operating procedures (SOPs) for all stages of incident response.
• Create new detection rules and refine existing alerts to improve monitoring tool accuracy.
• Coordinate technical responses and communicate status updates to key stakeholders during active incidents.
• Manage post-compromise activities including the removal of malicious artifacts and recovery of services.
• Aggregate threat feeds to create information briefings for senior leadership.

What we're looking for

• 6+ years of experience working in a Security Operations Center (SOC) at a classified level within the Department of Defense.
• Experience leading every phase of the incident lifecycle, including triage, deep-dive investigation, and remediation strategies.
• Experience evolving continuous monitoring toolsets by generating new detection rules and refining existing alerts.
• Experience developing and maturing standard operating procedures (SOPs) and SOC responsibilities across the incident response lifecycle.
• Ability to manage post-compromise activities, including artifact eradication, service recovery, and generating After-Action Reports.
• Ability to serve as a primary focal point for technical coordination and communication during active incident response operations.
• High school diploma or GED.
• Ability to obtain an 8570 DoW approved CSSP baseline certification before start date.
• Experience using Elastic for monitoring, analysis, and case management (preferred).
• Experience using endpoint tools to hunt for adversarial behavior (preferred).
• Experience with GCFA, GNFA, or equivalent digital forensics (preferred).
• Ability to conduct threat hunting using network and host-based information (preferred).
• TS/SCI clearance with a polygraph (preferred).
• 8570 CSSP Analyst or Incident Responder Certification (preferred).