Job Requirements
Fort Bragg, NC
Secret Polygraph not specified
Early Career (2+ yrs experience)
$40,000 - $50,000
Job Description
Our client is seeking SOC Analysts at Tiers 1, 2, and 3 to support the U.S. Army Reserve Command (USARC) Defensive Cyberspace Operations Mission Support Services (DCOMSS) program at Fort Bragg, North Carolina.
These positions support cyber defense monitoring, alert triage, incident investigation, threat hunting, and incident response. Responsibilities range from initial event analysis and escalation to leading complex intrusion investigations and improving detection coverage. Candidates will be considered for the tier that aligns with their experience and qualifications.
**Essential Duties and Responsibilities**
**Tier 1 — SOC Analyst**
- Monitor SIEM alerts, sensor events, host detections, and approved watch queues for suspicious activity.
- Triage events using approved playbooks, correlate basic evidence, and distinguish actionable activity from false positives.
- Create accurate tickets, identify applicable incident categories, preserve supporting artifacts, and maintain timely status updates.
- Escalate events to Tier 2 under documented thresholds and communicate context during shift handoffs.
- Follow approved response procedures and maintain records needed for operational reporting and quality review.
- Support exercises and surge work within assigned qualification, system access, and authority.
**Tier 2 — SOC Analyst**
- Investigate escalated alerts using SIEM, EDR, network flow, packet, firewall, authentication, proxy, and host data.
- Develop event timelines, identify affected systems and indicators, and assess scope and potential mission impact.
- Recommend containment and eradication steps to authorized Government personnel and track approved actions.
- Maintain incident records and required portal updates through closure, with evidence and rationale for decisions.
- Review Tier 1 tickets for completeness and coach analysts on investigation and documentation quality.
- Escalate complex intrusions and suspected advanced activity to Tier 3; support shifts and exercises as assigned.
**Tier 3 — SOC Analyst / Incident Response Lead**
- Lead analysis of complex intrusions and suspected advanced persistent threat activity across host, network, and intelligence sources.
- Direct technical incident investigation, evidence handling, scope assessment, and response recommendations.
- Coordinate containment, eradication, recovery, and reporting with authorized Government stakeholders.
- Plan advanced hunts and develop or validate correlation rules, YARA content, and network or host detections.
- Review significant incident records and ensure findings, actions, and handoffs are complete and timely.
- Mentor lower-tier analysts, improve playbooks, and support exercises and surge response.
All tiers perform other duties as assigned consistent with the position's responsibilities, qualifications, clearance, and authorized scope.
**Required Qualifications**
**Tier 1**
- Minimum 1 year of documented relevant cyber defense or network security monitoring experience, including SIEM triage, network traffic analysis, accurate incident records, and shift handoff.
- DoD Cyber Workforce Framework (DCWF) 511, Cyber Defense Analyst. Recruit for Intermediate proficiency; Basic eligibility is subject to Government confirmation for this position.
**Tier 2**
- Minimum 3 years of documented relevant cyber defense analysis and incident investigation experience, including SIEM, network traffic analysis, multi-source correlation, and incident documentation.
- DCWF 511, Cyber Defense Analyst, Intermediate proficiency.
**Tier 3 / Incident Response Lead**
- Minimum 5 years of documented relevant incident response and cyber defense experience in a DoD or enterprise setting, including CJCSM 6510.01B familiarity, advanced intrusion analysis, hunting, and detection engineering.
- DCWF 531, Cyber Defense Incident Responder, Advanced proficiency, and DCWF 511, Cyber Defense Analyst, Advanced proficiency.
- Qualification is required for both assigned roles.
**Cyber Workforce Qualifications and Certifications**
- Meet DoDM 8140.03 qualification requirements for every assigned work role and proficiency through an approved education, training, certification, or authorized experience route before independent cyber work.
- Document work-role appointment and qualification; maintain required residential qualification and continuing learning.
- A higher-level approved option may qualify the same role at a lower level.
- Matrix-listed certification options identified for DCWF 511 Intermediate: CEH(P), Cloud+, FITSP-O, GCED, GDSA, GMON, GRID, GSEC, PenTest+, Security+.
- Matrix-listed certification options identified for DCWF 531 Advanced: CFR, CySA+, GCFA, GCIA, GICSP.
- Matrix-listed certification options identified for DCWF 511 Advanced: CBROPS, CFR, CySA+, GCFA, GCIA, GICSP.
**Knowledge, Skills and Abilities**
- Knowledge appropriate to the assigned tier in SIEM monitoring, alert triage, network traffic analysis, incident documentation, evidence preservation, and escalation procedures.
- Proficiency with SIEM, IDS/IPS, EDR, packet or network analysis tools, and Windows and Linux systems appropriate to assigned duties and approved access.
- For Tier 2, experience with multi-source correlation, incident investigation, NetFlow, packet capture, and incident-management systems.
- For Tier 3, advanced knowledge of incident response, intrusion analysis, network and host forensics, threat hunting, detection engineering, and incident categorization.
- For Tier 3, proficiency with YARA, Snort or Suricata, and forensic or malware-analysis tools appropriate to assigned duties and approved access.
- Ability to produce accurate records, explain findings and decisions, and follow approved procedures and security requirements.
- Strong written and verbal communication skills and sound judgment when coordinating with technical staff and Government stakeholders.
- Strong organizational skills, confidentiality, and ability to work independently and collaboratively in a mission-focused environment.
**Preferred Qualifications**
- Experience in a 24/7 security operations center or DoD network environment.
- Experience investigating incidents in a DoD or enterprise security operations center.
- For Tier 3, experience leading major incident response in a DoD or enterprise environment.
- Relevant DoD or enterprise IT experience with mission tooling and operational reporting.
**Security Clearance**
Active SECRET clearance and ability to maintain assigned system access. U.S. citizenship is required.
**Supervisory Responsibilities**
Tier 2 provides technical review and coaching to Tier 1 analysts. Tier 3 serves as technical lead for incident investigations and mentors analysts; formal personnel supervision depends on assignment.
**Work Environment and Physical Requirements**
Work is primarily performed on site in a secure Government facility using computer systems and standard office equipment. The employee must be able to perform sustained computer-based analysis or coordination, communicate effectively, and support operational activities outside standard business hours when assigned. Mission-essential watch roles may include shifts, weekends, and holidays.
Reasonable accommodations may be made to enable qualified individuals with disabilities to perform the essential functions of the position.
**Travel**
Occasional local, CONUS, or OCONUS travel may be required for authorized mission activities, exercises, assessments, or conferences.
These positions support cyber defense monitoring, alert triage, incident investigation, threat hunting, and incident response. Responsibilities range from initial event analysis and escalation to leading complex intrusion investigations and improving detection coverage. Candidates will be considered for the tier that aligns with their experience and qualifications.
**Essential Duties and Responsibilities**
**Tier 1 — SOC Analyst**
- Monitor SIEM alerts, sensor events, host detections, and approved watch queues for suspicious activity.
- Triage events using approved playbooks, correlate basic evidence, and distinguish actionable activity from false positives.
- Create accurate tickets, identify applicable incident categories, preserve supporting artifacts, and maintain timely status updates.
- Escalate events to Tier 2 under documented thresholds and communicate context during shift handoffs.
- Follow approved response procedures and maintain records needed for operational reporting and quality review.
- Support exercises and surge work within assigned qualification, system access, and authority.
**Tier 2 — SOC Analyst**
- Investigate escalated alerts using SIEM, EDR, network flow, packet, firewall, authentication, proxy, and host data.
- Develop event timelines, identify affected systems and indicators, and assess scope and potential mission impact.
- Recommend containment and eradication steps to authorized Government personnel and track approved actions.
- Maintain incident records and required portal updates through closure, with evidence and rationale for decisions.
- Review Tier 1 tickets for completeness and coach analysts on investigation and documentation quality.
- Escalate complex intrusions and suspected advanced activity to Tier 3; support shifts and exercises as assigned.
**Tier 3 — SOC Analyst / Incident Response Lead**
- Lead analysis of complex intrusions and suspected advanced persistent threat activity across host, network, and intelligence sources.
- Direct technical incident investigation, evidence handling, scope assessment, and response recommendations.
- Coordinate containment, eradication, recovery, and reporting with authorized Government stakeholders.
- Plan advanced hunts and develop or validate correlation rules, YARA content, and network or host detections.
- Review significant incident records and ensure findings, actions, and handoffs are complete and timely.
- Mentor lower-tier analysts, improve playbooks, and support exercises and surge response.
All tiers perform other duties as assigned consistent with the position's responsibilities, qualifications, clearance, and authorized scope.
**Required Qualifications**
**Tier 1**
- Minimum 1 year of documented relevant cyber defense or network security monitoring experience, including SIEM triage, network traffic analysis, accurate incident records, and shift handoff.
- DoD Cyber Workforce Framework (DCWF) 511, Cyber Defense Analyst. Recruit for Intermediate proficiency; Basic eligibility is subject to Government confirmation for this position.
**Tier 2**
- Minimum 3 years of documented relevant cyber defense analysis and incident investigation experience, including SIEM, network traffic analysis, multi-source correlation, and incident documentation.
- DCWF 511, Cyber Defense Analyst, Intermediate proficiency.
**Tier 3 / Incident Response Lead**
- Minimum 5 years of documented relevant incident response and cyber defense experience in a DoD or enterprise setting, including CJCSM 6510.01B familiarity, advanced intrusion analysis, hunting, and detection engineering.
- DCWF 531, Cyber Defense Incident Responder, Advanced proficiency, and DCWF 511, Cyber Defense Analyst, Advanced proficiency.
- Qualification is required for both assigned roles.
**Cyber Workforce Qualifications and Certifications**
- Meet DoDM 8140.03 qualification requirements for every assigned work role and proficiency through an approved education, training, certification, or authorized experience route before independent cyber work.
- Document work-role appointment and qualification; maintain required residential qualification and continuing learning.
- A higher-level approved option may qualify the same role at a lower level.
- Matrix-listed certification options identified for DCWF 511 Intermediate: CEH(P), Cloud+, FITSP-O, GCED, GDSA, GMON, GRID, GSEC, PenTest+, Security+.
- Matrix-listed certification options identified for DCWF 531 Advanced: CFR, CySA+, GCFA, GCIA, GICSP.
- Matrix-listed certification options identified for DCWF 511 Advanced: CBROPS, CFR, CySA+, GCFA, GCIA, GICSP.
**Knowledge, Skills and Abilities**
- Knowledge appropriate to the assigned tier in SIEM monitoring, alert triage, network traffic analysis, incident documentation, evidence preservation, and escalation procedures.
- Proficiency with SIEM, IDS/IPS, EDR, packet or network analysis tools, and Windows and Linux systems appropriate to assigned duties and approved access.
- For Tier 2, experience with multi-source correlation, incident investigation, NetFlow, packet capture, and incident-management systems.
- For Tier 3, advanced knowledge of incident response, intrusion analysis, network and host forensics, threat hunting, detection engineering, and incident categorization.
- For Tier 3, proficiency with YARA, Snort or Suricata, and forensic or malware-analysis tools appropriate to assigned duties and approved access.
- Ability to produce accurate records, explain findings and decisions, and follow approved procedures and security requirements.
- Strong written and verbal communication skills and sound judgment when coordinating with technical staff and Government stakeholders.
- Strong organizational skills, confidentiality, and ability to work independently and collaboratively in a mission-focused environment.
**Preferred Qualifications**
- Experience in a 24/7 security operations center or DoD network environment.
- Experience investigating incidents in a DoD or enterprise security operations center.
- For Tier 3, experience leading major incident response in a DoD or enterprise environment.
- Relevant DoD or enterprise IT experience with mission tooling and operational reporting.
**Security Clearance**
Active SECRET clearance and ability to maintain assigned system access. U.S. citizenship is required.
**Supervisory Responsibilities**
Tier 2 provides technical review and coaching to Tier 1 analysts. Tier 3 serves as technical lead for incident investigations and mentors analysts; formal personnel supervision depends on assignment.
**Work Environment and Physical Requirements**
Work is primarily performed on site in a secure Government facility using computer systems and standard office equipment. The employee must be able to perform sustained computer-based analysis or coordination, communicate effectively, and support operational activities outside standard business hours when assigned. Mission-essential watch roles may include shifts, weekends, and holidays.
Reasonable accommodations may be made to enable qualified individuals with disabilities to perform the essential functions of the position.
**Travel**
Occasional local, CONUS, or OCONUS travel may be required for authorized mission activities, exercises, assessments, or conferences.
group id: 91173093