Tier II SOC Analyst

Tier II SOC Analyst
Clearance: Active TS/SCI
12mo C2H (4+ years left on the program)
Rate: Negotiable depending on experience
Shifts: 6am-2pm, 2pm-10pm, 10pm-6am (3 openings)

Overview
To be successful in this position you need to be collaborative and able to lead the technical mission on your shift. You need to be a self-starter, completing your tasks on your own, while conducting quality assurance on the tasks of others on shift. Working together is critical in this role. You will be interfacing with the Government and senior staff. Therefore, you should be articulate in verbal and written communications, complex, technical concepts in plain business language.

Summary
The position entails working in a Network Operations and Security Center NOSC where the team is responsible for monitoring security and health alerts for systems on 14 different networks. The ideal candidate for this position will lead the security mission in the NOSC by providing training to junior analysts, reviewing reports written by the junior analysts, tuning tools for anomalous detection, writing reports, presentations, and executive summaries.

Work Schedule
This position works 8-hour shifts on business days, with occasional on-call support for weekends as needed (frequency and expectations to be discussed during the interview process)

Key Responsibilities
• Analyze and investigate escalated alerts from Tier 1 analysts using tools such as SIEM, EDR, IDS/IPS, and network monitoring solutions.
• Perform advanced log analysis, PCAP review, and endpoint investigations to determine the nature and scope of threats.
• Lead incident response activities for escalated events, collaborating with Tier 3 analysts for complex or high-severity incidents.
• Prepare detailed incident reports and deliver briefings to internal stakeholders, including senior leadership.
• Collaborate with Tier 3 analysts, system administrators, and other IT teams to implement mitigation strategies.
• Mentor and provide technical guidance to Tier 1 NSOC analysts, including training on incident handling and response procedures.
• Assist in tuning detection tools and developing use cases for anomalous activity detection.
• Develop, update, and maintain comprehensive documentation ensuring accuracy and alignment with current protocols and best practices

Required Qualifications
Leadership:
o 2+ years’ Experience mentoring or providing technical guidance to junior NSOC analysts, or leading incident response efforts.
Education:
o Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field (or equivalent experience).

Experience:
o 3-6 years of experience in a SOC or cybersecurity operations role, with proven experience investigating and responding to security incidents

Technical Skills:
Proficiency with SIEM platforms (e.g., Splunk) and endpoint detection tools (e.g., CrowdStrike, Sentinel One, Microsoft Defender).
Strong understanding of network protocols, packet analysis, and tools like Wireshark or Zeek.
Experience with IDS/IPS/NDR/EDR tools (e.g., Snort, Suricata, Bricata).
Ability to analyze logs, correlate data, and detect adversary tactics, techniques, and procedures (TTPs).
Familiarity with threat intelligence frameworks such as MITRE ATT&CK, Cyber Kill Chain, and IOC analysis.
Basic scripting or automation skills (e.g., Python, PowerShell, Bash) to enhance workflows.

Certifications:
o DoD 8140 Cyber Incident Responder Certification (Security+, CySA+, or equivalent) required.
o One or more of the following certifications are preferred: GCIH, GCFA, Cloud+, GCSA.

Security Clearance:
o DoD Top Secret Clearance with SCI/SAP eligibility is required.

Soft Skills:
o Strong analytical and critical thinking skills to investigate incidents and determine root causes.
o Excellent written and verbal communication skills for technical reporting and briefings.
o Ability to mentor junior analysts and work collaboratively in a fast-paced environment.

Preferred Qualifications
• Experience with forensic tools (e.g., FTK, EnCase, Volatility).
• Hands-on experience with cloud security monitoring in AWS, Azure, or GCP.
• Familiarity with Threat Hunting methodologies and tools.
• Experience participating in a DOD CSSP Inspection

Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to specific elections, plan, or program terms.  If eligible, the benefits available for this temporary role may include the following:

Medical, dental & vision
Critical Illness, Accident, and Hospital
401(k) Retirement Plan – Pre-tax and Roth post-tax contributions available
Life Insurance (Voluntary Life & AD&D for the employee and dependents)
Short and long-term disability
Health Spending Account (HSA)
Transportation benefits
Employee Assistance Program
Time Off/Leave (PTO, Vacation or Sick Leave)

This position requires an active DoD Clearance (Secret, Top Secret, Top Secret/SCI) or the ability to be obtain an (Interim Secret, Interim Top Secret)
Because an active or interim DoD clearance is required, U.S. Citizenship is required.