Cyber Defense & Vulnerability Operations Analyst

Nakupuna Companies•Charleston, SC

About The Position

The Cyber Defense & Vulnerability Operations Analyst supports Navy ERP through continuous security monitoring, alert analysis, and enterprise vulnerability management. The role investigates and responds to indicators of compromise across databases, operating systems, and middleware; oversees required scanning; tracks compliance; and submits data to DoD repositories, including VRAM and CMRS. The analyst also leads remediation meetings with database, application, and infrastructure subject matter experts to address identified vulnerabilities. The position monitors security alerts, analyzes and escalates suspicious activity, engineers SIEM content, conducts vulnerability scans, tracks asset and endpoint coverage, and prepares compliance and vulnerability reporting. It requires coordination with technical SMEs and maintenance of threat-response playbooks, scanning schedules, and operational SOPs.

Requirements

At least 4 years of experience in SOC analysis, cyber defense, or vulnerability assessment within DoD/Navy environments.
Advanced knowledge of Splunk, including SPL query language, Enterprise Security, correlation searches, and alerting.
Operational experience with Tenable ACAS, including Nessus and SecurityCenter.
Operational experience with DoD HBSS/ESS, including Trellix ePO, agent verification, and module status.
Direct experience uploading and tracking vulnerability data in VRAM and CMRS.
Foundational understanding of enterprise databases, including SAP HANA and Oracle, and operating-system security.
DoD 8570/8140 CSSP Analyst or IAT II/III baseline certification, such as CySA+, CEH, CASP+ CE, or CISSP.
Must be a U.S. citizen.
Must meet the stated physical requirements, with or without reasonable accommodation: repetitive hand, wrist, and finger motions; ability to engage in and follow audible communications during emergencies; and ability to sit for prolonged periods at a desk and work on a computer.

Nice To Haves

Splunk Certified Cybersecurity Defense Analyst or Splunk Core Certified Advanced Power User.
DISA HBSS 201/301 Administrator training or Tenable ACAS certification.
Prior experience coordinating with NAWC-AD or Navy program office cyber teams.

Responsibilities

Monitor real-time security alerts from Splunk, Tripwire, and HBSS in accordance with SOPs.
Triage, analyze, and escalate suspicious events, anomalous behaviors, and security incidents.
Conduct activity monitoring across Navy ERP databases, operating systems, applications, and middleware, including SAP HANA, Oracle, Sybase, Windows Server, Linux, Tripwire, webMethods, and IBM Tivoli.
Develop, refine, and optimize correlation searches within Splunk Enterprise Security.
Tune detection logic to reduce false positives and improve detection fidelity.
Design custom Splunk dashboards, scheduled alerts, and compliance-tracking metrics.
Define data requirements and logging standards for new inbound data sources.
Schedule, execute, and validate weekly and ad-hoc ACAS (Tenable) vulnerability scans.
Schedule, execute, and review weekly and ad-hoc Onapsis scans across SAP instances.
Ensure all Navy ERP assets receive required policy scans.
Monitor HBSS/ESS agent coverage across endpoints and coordinate with NAWC-AD data center HBSS administrators.
Export verified ACAS scan results and upload them to VRAM.
Consolidate vulnerability data and HBSS status metrics for regular submission to CMRS.
Generate and distribute vulnerability assessment reports to technical SMEs.
Lead or back up weekly vulnerability review meetings with system, database, and platform SMEs.
Track remediation milestones and validate post-remediation rescans.
Maintain and update threat-response playbooks, scanning schedules, and operational SOPs.