About This Role
This SOC Analyst role supports the administration, maintenance, and optimization of cybersecurity infrastructure for mission-critical US Government programs. It suits a security-cleared professional with a background in enterprise IT services and a focus on cybersecurity, who can work independently in a hybrid on-premise and cloud environment.
Responsibilities
- Provide support for the administration, maintenance, configuration, patching, upgrades, and optimization of security tools, devices, application systems, servers, and sensors within the cybersecurity infrastructure
- Maintain SIEM applications to collect and aggregate operating systems, IDS and IPS data from network sensors, raw data from collection agents, firewalls, proxy servers, DLP, antivirus, vulnerability scanner elements, and other security-relevant devices
- Support and evolve the interfaces between operations, network, SOC, and operating systems information into the SIEM tool using information from and input from ISSOs; perform asset categorization and prioritization
- Monitor DHS S&T systems, networks, and applications for malicious activity and utilize security tools and technologies to detect, analyze potential threats, and respond to agency and component level security alerts
- Analyze cybersecurity systems to identify vulnerabilities and trends
- Analyze threat intelligence and data to identify computer attacks and probes
- Respond to cybersecurity incidents and provide incident response services
- Assist in developing playbooks and long-term security strategies and advise on cybersecurity policies
- Collaborate with other service areas within S&T to help analyze and solve common cybersecurity concerns and problems
- Assist in documenting incidents and actions taken by the SOC analyst team
- Prepare, provide, and discuss detailed reports with other teams and management
Requirements
- Ability to obtain a Public Trust issued by the Department of Homeland Security (DHS)
- Bachelor's Degree with 3 years of experience within an enterprise IT services environment, providing technical support with emphasis on cybersecurity
- Demonstrated experience with network and security management tool suites, with an emphasis on SIEM and growing towards SOAR solutions
- Knowledge of deploying, developing, and maintaining SOC oriented services and systems within a hybrid on-premise and cloud-oriented enterprise class environment
- Working knowledge of a variety of security / networking technologies to communicate and collaborate with other engineers
- Ability to learn and understand complex and dynamically changing environments
- Self-starter, able to work independently, and able to manage time effectively
- Working knowledge of cloud platforms such as AWS/Azure
