Security Operation Center (SOC) Analyst I

US Citizenship Required

About the role

The SOC Analyst’s primary function is to provide comprehensive Computer Network Defense and Response support through 24×7×365 monitoring and analysis of potential threat activity targeting the enterprise. This position will conduct security event monitoring, advanced analytics, and response activities in support of the government’s mission. This position requires a solid understanding of cyber threats and information security in the domains of TTPs, Threat Actors, Campaigns, and Observables.

Additionally, this candidate must be familiar with intrusion detection systems, intrusion analysis, security information event management platforms, endpoint threat detection tools, and security operations ticket management. This position will provide “day-to-day” support for Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities.

Responsibilities

• Lead efforts in Incident Handling (Detection, Analysis, Triage), Hunting (anomalous pattern detection and content management), and Malware Analysis.
• Analyze information technology security events to discern events that qualify as legitimate security incidents as opposed to non-incidents, including security event triage, incident investigation, implementing countermeasures, and conducting incident response.
• Operate and maintain Security Information and Event Monitoring (SIEM) platforms and/or log management systems that perform log collection, analysis, correlation, and alerting.
• Analyze security events (Windows event logs, network traffic, IDS events) for malicious intent using strong logical and critical thinking abilities.
• Track activities within various Security Operation workflows with excellent organizational skills and attention to detail.
• Identify and implement counter-measures or mitigating controls for deployment in the enterprise network environment.
• Develop rules, filters, views, signatures, countermeasures, and operationally relevant applications and scripts to support analysis and detection efforts.
• Research emerging threats and recommend monitoring content within security tools.
• Analyze NetFlow data and packet capture (PCAP).
• Apply robust knowledge of common attack methodologies, tactics, and protocols, TCP/IP protocol suite, security architecture, DNS, and remote access security techniques and products.
• Utilize a mix of security technologies such as: Intrusion Detection & Prevention systems (IDS/IPS), Firewalls & Log Analysis, SIEM, Network Behavior Analysis tools, Antivirus, Network Packet Analyzers, Digital Forensics tools, and Cyber Incident Response activities in an Enterprise environment.

Requirements

• 2+ years of related experience in cyber incident response, network defense, or security operations.
• Prior performance in roles such as ISSO or ISSM; SAP experience desired.
• Bachelor’s degree in a related area OR Associate’s degree in a related area + 2 years’ experience OR equivalent experience (4 years).
• Must currently possess a Top Secret/SCI clearance and be able to obtain a TS/SCI with CI Polygraph.
• CSSP Analyst, Auditor, or Incident Responder certification (e.g., CEH, CFR, CCNA Cyber Ops, CySA+, GCIA, GCIH, GIC SP, SCYBER) required within 6 months of hire.
• Working knowledge of various operating systems (Windows, OS X, Linux) commonly deployed in enterprise networks, including a conceptual understanding of Windows Active Directory.
• Working knowledge of network communications and routing protocols (TCP, UDP, ICMP, BGP, MPLS) and common internet applications and standards (SMTP, DNS, DHCP, SQL, HTTP, HTTPS).
• Experience with one or more of the following technologies: Network Threat Hunting, Big Data Analytics, Endpoint Threat Detection and Response, SIEM, workflow and ticketing, and Intrusion Detection System.

Pay

The likely salary range for this position is $86,105 - $116,495. Salary will be set based on experience, geographic location, and possibly contractual requirements.

Schedule

• Scheduled Weekly Hours: 40
• Travel Required: 10-25%
• Telecommuting Options: Onsite
• Work Location: USA CO Colorado Springs

Benefits

• Medical plan options, some with Health Savings Accounts.
• Dental and vision plan options.
• 401(k) plan with pre- and post-tax contribution options and company match.
• Paid time off, including vacation, sick, personal time, holidays, parental leave, military leave, bereavement, and jury duty leave.
• Short- and long-term disability benefits.
• Life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance.