SOC Analyst

About This Role

This SOC Analyst position involves the 24/7/365 monitoring and analysis of security event alerts across an enterprise network. The role requires reviewing incoming alerts, investigating potential threats, and ticketing them using an incident response platform. It suits a candidate who can obtain a Public Trust clearance and has experience in a Security Operations Center environment.

Responsibilities

• Provide 24/7/365 monitoring and analysis of security event alerts across the enterprise network
• Monitor agency systems and daily log events to identify potential security threats, utilizing sensor alert logs, firewall logs, content filtering logs, and Security Information and Event Management logs
• Review incoming alerts, investigate, and ticket all identified potential security threats using the agency's incident response ticketing platform
• Prioritize all incoming alerts and respond accordingly in a timely manner
• Validate traffic and/or network activity (per alerts/logs) as anomalous in accordance with agency standards and procedures
• Identify, investigate, and escalate potential security threats to senior agency resources when needed
• Measure and model traffic, while identifying patterns and ports
• Produce reports, both contractual and ad hoc, providing information on events, trends, issues, and activity as requested by the federal customer
• Provide data for inclusion in the agency’s CISA report
• Utilize OSINT tools to identify and mitigate potential cybersecurity threats to the customer’s network
• Identify the necessity for, and implementation of, the creation of new intrusion detection signatures
• Provide detailed documentation of reported incidents utilizing ServiceNow
• Perform triage, investigations, and respond to a wide variety of alerts

Requirements

• Minimum of 2-4 years of experience as an analyst in a SOC or similar environment
• Working knowledge of SOC tools and their usage for detecting intrusion attempts
• Demonstrated experience creating custom intrusion signatures to detect specific network traffic anomalies
• Demonstrated experience in populating sensors with newly available signatures when responding to events or management requests
• Knowledge of potential threat reporting and tracking by means of at least one large-scale ticketing system (ServiceNow, CAPRS, or other similar system)
• Ability to utilize email, instant messaging, and other monitoring tools to effectively navigate through the incident response process
• Strong oral presentation skills and the ability to articulate English in a clear and concise manner
• Demonstrated experience with Windows Operating System and Microsoft 365 tools