Junior Security Operations Center Analyst

About the role

The Junior Security Operations Center (SOC) Analyst will be part of the War Data Platform (WDP) team at the U.S. Department of War. The WDP is a critical component of the DoW's AI-First strategy, designed to enhance cybersecurity and AI deployment on the battlefield.

Responsibilities

• Perform entry-level cyber defense and continuous monitoring operations across WDP’s classified and unclassified network environments.
• Maintain situational awareness through review of threat intelligence feeds, internal advisories, and IAVA notifications.
• Monitor security dashboards and alert queues generated by Security Information and Event Management (SIEM) platforms like Splunk and Elastic, identifying indicators of compromise, policy violations, and anomalous system behavior.
• Conduct initial alert triage using documented incident response playbooks aligned with DoW Cyber Incident Handling Program guidelines, validating event severity and routing incidents through ServiceNow workflows.
• Execute basic investigation steps including log review, endpoint status verification, and correlation of host and network telemetry under senior analyst direction.
• Document investigative actions, timelines, and observations within SharePoint repositories and ticketing systems to support auditability and continuous monitoring requirements under the Risk Management Framework.
• Support containment and remediation efforts by coordinating with system administrators, vulnerability management teams, and Information System Security Officers during active incidents.
• Deliver reliable alert processing, accurate documentation, and disciplined escalation practices that sustain operational readiness, protect mission systems, and strengthen cyber defense posture across supported operational environments.

Requirements

• Current Secret security clearance.
• Experience in cybersecurity operations, IT security, network monitoring, or a closely related discipline, including relevant academic, internship, or lab-based experience demonstrating foundational cyber defense skills.
• IAM Level I certification from an approved credential, such as CompTIA Security+, ISC² CAP, ISC² SSCP, or GIAC G.
• Hands-on familiarity with SIEM platforms such as Splunk or Elastic, including experience navigating dashboards, constructing basic queries, and reviewing log data in a lab, academic, or professional cybersecurity environment.
• Basic understanding of the MITRE ATT&CK framework and common adversary tactics, techniques, and procedures, with a demonstrated interest in applying threat intelligence concepts to alert triage and incident investigation workflows.
• Exposure to IT service management platforms such as ServiceNow or equivalent ticketing systems, including experience logging, tracking, and documenting security events or IT incidents within structured workflow environments.
• Familiarity with Risk Management Framework concepts and DoW or federal continuous monitoring obligations, including awareness of NIST 800-53 security controls, IAVA notification processes, and the role of cybersecurity documentation in supporting system authorization activities.

Qualifications

• Active Top Secret (TS) security clearance with Sensitive Compartmented Information (SCI) eligibility.

Skills

• Strong analytical and problem-solving skills.
• Effective communication and teamwork abilities.
• Ability to work independently and as part of a team.
• Attention to detail and ability to manage multiple tasks simultaneously.

Benefits

As a valued member of the Everforth ECS team, you will enjoy competitive compensation, comprehensive benefits, and a supportive work environment. We offer a range of benefits including health insurance, retirement plans, paid time off, and more.

Pay

Compensation details will be provided upon successful completion of the hiring process.

Schedule

The position requires a flexible schedule to accommodate shifts and operations in the National Capital Region, covering the Pentagon, Falls Church, and Fairfax.