Data Security Analyst - Journeyman

Job Description Position Summary

ECS is seeking a Data Security Analyst - Journeyman to support the Army National Guard (ARNG) Enterprise Network Operations and Cybersecurity Support (ENOCS) program. This position supports Task 3 - Cybersecurity Operations Support - by engineering data integration solutions that enable reliable ingestion, parsing, and transformation of cybersecurity telemetry across SOC, CDAP, and analytic platforms. The role works closely with analytic developers, security engineers, and cybersecurity operations personnel to improve data quality, resolve ingestion discrepancies, and sustain continuous monitoring visibility that supports Defensive Cyberspace Operations - Internal Defensive Measures (DCO-IDM) across the DoDIN-Army-NG area of responsibility.

Please Note: This position is contingent upon contract award.

This role contributes to protection of ARNG classified and unclassified network environments supporting more than 120,000 users and approximately 141,000 endpoints across about 2,800 sites in 54 states and territories. The Data Security Analyst - Journeyman helps enable centralized visibility and machine-speed response through integrated SIEM/C2C/DLP analytics, supports coordination with USIEM engineers on enabling data sources, and helps maintain actionable cyber data flows for operations conducted in coordination with the NETCOM Global Cyber Center and DISA DCDC. The position directly supports ARNG Title 10 and Title 32 missions, including mobilization readiness, domestic emergency response, and cybersecurity operations spanning both NIPRNet and SIPRNet environments.
Responsibilities

• Engineer data integration solutions that support reliable ingestion, normalization, parsing, and transformation of cybersecurity telemetry across SOC, CDAP, and analytic platforms.
• Implement schema management and data validation routines to improve data accuracy, traceability, and consistency for cybersecurity monitoring and reporting.
• Optimize data pipelines and processing performance to support scalable visibility across ARNG's distributed enterprise of approximately 141,000 endpoints and 2,800 sites.
• Collaborate with analytic developers and security engineers to resolve ingestion discrepancies, improve telemetry quality, and strengthen threat-informed detections.
• Support integrated SIEM/C2C/DLP analytics by preparing and refining data feeds that enable centralized visibility and faster cyber defense actions.
• Coordinate with USIEM engineers to identify, onboard, and improve enabling data sources used for monitoring, correlation, and MITRE ATT&CK-based analytics.
• Maintain data quality and continuous monitoring visibility that supports 24x7x365 cybersecurity operations across ARNG classified and unclassified network environments.
• Assist in producing reliable data outputs that support monitoring, incident analysis, reporting, and governance activities aligned with ARNG and DoD cybersecurity policy.
• Contribute to data handling and telemetry support for cybersecurity operations conducted in coordination with the NETCOM Global Cyber Center and DISA DCDC.

Required Skills Required Qualifications

U.S. Citizenship is required

Security Clearance: Secret Eligible

Required Certifications: DCWF Work Role 511-Cyber Defense Analyst - Basic proficiency; must hold ONE OR MORE of the following: CC, CEH, GFACT, GISF

Experience: 3+ years of experience in cybersecurity

• Experience engineering or supporting data ingestion, parsing, and transformation workflows for cybersecurity telemetry.
• Experience implementing data validation, schema management, or related controls to improve data quality for security operations use.
• Experience supporting continuous monitoring, analytic visibility, or reporting within a cybersecurity operations environment.
• Experience collaborating with security engineers, analysts, or analytic developers to troubleshoot data discrepancies and improve operational outputs.
• Ability to support telemetry integration and reporting needs across multiple cybersecurity platforms or operational teams.
• Experience documenting data issues, validation results, and corrective actions in support of operational monitoring and governance.

Desired Skills Desired Qualifications

Security Clearance: Active Secret (preferred)

• Experience supporting SIEM, C2C, or DLP data integration activities in a DoD cybersecurity environment.
• Experience working with USIEM-related data feeds, correlation support, or MITRE ATT&CK-based analytic use cases.
• Familiarity with cybersecurity telemetry sources referenced in the ENOCS environment, such as Zeek metadata or Sysmon-based monitoring.
• Experience supporting cyber operations for both classified and unclassified environments, including NIPRNet or SIPRNet-connected operations.
• Familiarity with ARNG, Army, or NETCOM-aligned cybersecurity operations, reporting, or continuous monitoring practices.

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

is the federal segment of , a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.

Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

We value:

• Attracting and developing top talent and high-performing teams
• Fostering a culture that is engaging, accountable, and mission-driven