Cyber Intrusion Analyst

TEKsystems•Honolulu, HI

7d•$50 - $70•Onsite

About The Position

The Cyber Intrusion Analyst supports a large enterprise Department of Defense program by providing real-time cyber intrusion analysis in a high-visibility Security Operations Center (SOC). The role detects, investigates, and responds to network security incidents in collaboration with Cyber Defense Service Provider (CND-SP/CSSP) teams, helping protect mission-critical systems and networks. As a technical leader, the analyst supports the integrity and security of enterprise environments, guides use of monitoring tools, and helps develop and tune countermeasures against emerging threats. This is a fully on-site role in Ford Island, Hawaii, operating within a 24/7/365 SOC. Analysts work across day, swing, and night/mid shifts, in pairs, to ensure continuous coverage. The environment is secure, mission-focused, collaborative, structured, and process-driven, with formal monitoring policies, incident reporting procedures, and an emphasis on operational discipline and situational awareness. The role involves extensive use of Splunk, Elastic, IDS/IPS platforms, raw packet capture and netflow analysis tools, and DoD-approved monitoring and traffic analysis solutions. The position is contract-to-hire and is based in Honolulu, Hawaii. The stated pay range is $50.48–$69.72 per hour. Eligible benefits for this temporary role may include medical, dental and vision coverage; critical illness, accident and hospital coverage; a 401(k) retirement plan; life insurance; short- and long-term disability; a health spending account; transportation benefits; an employee assistance program; and time off or leave.

Requirements

At least 4 years of overall professional experience, preferably combined with a bachelor's degree.
Active Secret clearance; an active Top Secret clearance is preferred.
At least 2 years of Computer Network Defense analysis experience, including hands-on use of SIEM tools such as Splunk or other SIEM platforms.
Experience performing CND duties across Protect, Defend, Respond, and Sustain, including configuring firewalls and IDS/IPS, auditing network traffic, hardening devices, and implementing security policies.
Demonstrated experience monitoring IDS and computer defense appliances, specifically using tools such as Splunk and Elastic.
Experience evaluating and interpreting packet captures and network traffic to identify security incidents.
Proficiency with command-line scripting, particularly PERL, Python, and/or Shell.
Prior experience supporting Department of Defense-related projects or programs.
Ability and willingness to work assigned shifts, including day, swing, or night schedules in a 24/7/365 SOC.
Strong incident response, cybersecurity, and vulnerability assessment skills, including familiarity with SIEM-driven workflows.
Security+ or equivalent baseline security certification in combination with a Top Secret clearance is identified as a core requirement.

Nice To Haves

Ability to obtain CYSA+ or CEH certification within 6 months of hire; holding these or other advanced cyber certifications at hire is a strong plus.
Experience in a high-tempo SOC or Cyber Defense environment supporting enterprise networks.
Familiarity with DoD network monitoring and traffic analysis tools and formal monitoring policies and procedures.
Experience analyzing low-level or “low and slow” events to uncover stealthy or persistent threats.
Strong analytical, problem-solving, and self-learning capabilities for investigating complex or ambiguous security events.
Effective communication skills for explaining findings, trends, and recommendations to leadership, peers, and mission partners.
Ability to collaborate in a team and provide technical leadership or mentorship to other analysts.
Comfort with structured reporting processes and formal incident documentation for mission partners.
Experience working with or within CSSP or CND-SP environments.

Responsibilities

Work with Government counterparts to provide expert CND-SP guidance aligned with mission needs and security objectives.
Provide CND reporting on trends, responses, mitigations, analysis, and information dissemination to leadership and mission partners.
Deliver command and control support and situational awareness for CND activities across Protect, Detect, Respond, and Sustain functions.
Serve as a technical leader on the CSSP team, maintaining the integrity and security of enterprise-wide systems and networks.
Support CND teams through predictive and reactive analysis, and communicate emerging trends and threats to leadership and staff.
Detect, correlate, identify, and characterize anomalous activity that may indicate threats to the enterprise.
Monitor security tools and applications, primarily Splunk and Elastic, and investigate potential malicious activity, alerts, and indicators.
Recommend courses of action and mitigation strategies based on security tool, log, and network traffic analysis.
Analyze low-level or “low and slow” events to identify unauthorized activity.
Perform near-real-time event triage and analysis, validate network traffic, and create incident reports for mission partners as needed.
Use formal monitoring policies and procedures and DoD-approved tools to identify suspicious, anomalous, or malicious network traffic on a 24/7/365 basis.
Review logs promptly to detect intrusions and notify mission partners through formal reporting processes.
Apply, develop, tune, distribute, or optimize countermeasures and guidance to prevent or mitigate cyber event impacts.
Analyze raw packet data, netflow, IDS/IPS data, and custom sensor output to identify and understand security events.
Configure and manage firewalls, IDS/IPS, and other security appliances to support Protect, Defend, Respond, and Sustain activities.
Audit network traffic, harden devices, and implement security policies.
Use PERL, Python, Shell, or other command-line scripting to automate tasks, streamline analysis, and improve operational efficiency.
Provide cyber incident handling expertise and real-time analysis for DoD-related projects or programs.
Collaborate with SOC analysts across multiple shifts to support continuous monitoring and consistent incident handling.