CSOS II/Tier 2

CACI International•St. Louis, MO

3d•$63,300 - $129,700•Onsite

About The Position

CACI is seeking a skilled CSOS II / Tier 2 Cybersecurity Analyst to join our Cyber Security Operations Center (CSOC). In this role, you will play a key part in a 24x7x365 mission to protect national security systems by identifying, containing, and responding to cybersecurity incidents. This position offers the chance to work hands-on with advanced malware analysis, digital forensics, and real-time incident response in a dynamic, highly collaborative environment. This role operates on Shift 5 (Saturday and Sunday- Weekend 1800 - 0600).

Requirements

Active TS/SCI clearance at start; the ability to obtain a Polygraph within 6 months is required.
Bachelor’s degree (BA/BS) or equivalent experience in lieu of a degree
Minimum 3 years of related cybersecurity experience.
DoD 8140.01 / DoD 8570.01-M compliant certifications: IAT Level II and CSSP Analyst certifications.

Responsibilities

Lead and support cyber incident response activities, including containment, eradication, and recovery actions such as IP/domain blocks and account disablement.
Perform in-depth malware analysis, forensic artifact handling, and digital media analysis across host, server, and network environments.
Coordinate investigations with internal and external partners, including Counterintelligence, Insider Threat, law enforcement, and other cybersecurity teams.
Document all actions and findings in authorized systems to ensure clear, reproducible records of analysis and response.
Categorize incidents, assess impact, and collaborate with stakeholders to ensure accurate and timely reporting.
Produce incident timelines, reports, briefings, and other materials to keep leadership informed of threat activity and response actions.
Develop indicators of compromise (IOCs) for distribution to cybersecurity stakeholders.
Build, maintain, and—when authorized—execute custom scripts, tools, and capabilities for data collection, analysis, and response.
Generate or update incident reports within JIMS, ICMS, and other approved systems as directed by the Government.
Support de-confliction between blue/red team activities and active incidents.
Provide comprehensive incident investigation reports that cover lifecycle analysis, adversary behavior, technical findings, and recommended improvements.