Cyber Real Time Analysts (TN22)

The Newberry Group•Cross Hill, SC

1d•$115,000 - $150,000•Onsite

About The Position

Newberry Group is seeking Cyber Real Time Analysts to support the customer’s Network Assurance and Defensive Cyber Operations team for the Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The role operates within the Global Services Management – Operations II Task Order 22 Boundary Cyber Defense and Cybersecurity Services Provider contract. The 24/7/365 watch cell protects the Department of Defense Information Network, U.S. Pacific Command, and mission partner enclaves from cyber threats. This is a full-time, onsite position; telework is not permitted. Travel is required approximately 10% of the time. Relocation expenses may be eligible for reimbursement up to $10,000. A $10,000 sign-on bonus may be available subject to a 12-month commitment. The analyst performs real-time boundary intrusion detection, cross-enclave incident response, and security monitoring across Unclassified, Secret, and Top Secret/SCI environments. The position supports boundary infrastructure and regional mission networks, including the PACOM Mission Network and Joint Operational Edge – Coalition Environment. The role requires a DoD active Top Secret clearance with SCI eligibility; a Secret clearance may be acceptable with Government approval. Salary is $115,000–$150,000 annually, depending on experience and position level. Candidates may be considered at Level II (Intermediate) or Level III (Senior). They must meet the relevant education and experience pathway for the level and hold a valid certification or related degree that meets DoD 8140.03 / DCWF Work Role Code 531 requirements at the Intermediate Proficiency Level before starting. Analysts must have SOC experience, networking knowledge, SIEM query and dashboard skills, and willingness to work rotating 10-hour shifts covering days, nights, weekends, and holidays onsite.

Requirements

For Level II: bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related discipline and at least 2 years of relevant CND experience; or an associate degree and at least 4 years; or at least 6 years of relevant experience/military service in lieu of a degree.
For Level III: bachelor’s degree and at least 4 years of relevant experience; or an associate degree and at least 6 years; or at least 8 years of relevant experience/military service in lieu of a degree.
Before starting, hold a valid certification or related degree meeting DoD 8140.03 / DCWF Work Role Code 531 (Cyber Defense Analyst - CSSP) at the Intermediate Proficiency Level. Accepted certifications include CySA+, CCNA-Security, GICSP, GSEC, Security+ CE, CND, CEH, or higher certifications such as CASP+ CE, CISSP, GCIA, or GCIH.
Proven experience in a Security Operations Center performing live alert triage, event correlation, and intrusion analysis.
Solid understanding of TCP/IP, DNS, BGP, HTTP/S, and network architecture inspection using tools such as Wireshark, TCPdump, and NetFlow.
Hands-on familiarity with SIEM querying and dashboard creation using Elastic KQL or Microsoft KQL.
Ability and willingness to work rotating 10-hour shifts covering days, nights, weekends, and holidays onsite at Ford Island, Hawaii.
Active DoD Top Secret clearance with SCI eligibility; Secret clearance may be acceptable with Government approval.

Nice To Haves

Direct experience monitoring DISA boundary systems such as IAP, BCAP, ERS, and Thunderdome ZTNA.
Working knowledge of the MITRE ATT&CK framework and its use in detection engineering and rule mapping.
Hands-on experience defending hybrid cloud architectures, including Azure Gov/IL-6, AWS GovCloud, and JWCC.
Familiarity with endpoint detection telemetry such as Microsoft Defender for Endpoint/Server, EndGuard, and Sysmon.
Prior experience with JIRA ticket workflows and DoD incident reporting tools such as Rally.
AI prompt capability using Gemini, Grok, or ChatGPT to automate repetitive triage workflows or author custom detection playbooks.

Responsibilities

Monitor and analyze intrusions, events, and vulnerabilities across DISA enterprise boundaries, including Internet Access Points, Boundary Cloud Access Points, Enterprise Recursive Services, and releasable/federal DODIN demilitarized zones.
Correlate network alerts, NetFlow, packet captures, Deep Packet Inspection, Deep File Inspection, Anomaly Based Protection, and IDS/IPS logs to confirm or refute suspected intrusions.
Use and recommend tuning for boundary cyber defense platforms, including Cisco FirePOWER, Next Generation Sensors, Arbor, Guardian, Web Content Filtering, Cloud-Based Internet Isolation, and BIND9 DNS security.
Maintain incident records in the DoD Incident Reporting Structure (currently Rally) in compliance with CJCSM 6510.01F timelines, and author Situational Awareness Reports and Tippers for DJOC and combatant commanders.
Conduct security analytics using DISA enterprise SIEM platforms, including Splunk, Microsoft Sentinel / Azure Lighthouse, and Elastic Stack.
Correlate endpoint telemetry and identity logs with perimeter alerts to establish attack kill chains across Zero Trust pillars.
Recommend detection signatures, tuning, and countermeasures for emerging threats and web exploits, including SQL injections, and coordinate rapid de-confliction.
Provide cyber defense operational support to CSSP subscribers, traditionally hosted data centers, and enterprise cloud enclaves.
Conduct cybersecurity operations on the PACOM Mission Network and Joint Operational Edge – Coalition Environment architectures at DISA PAC.
Monitor Identity, Credential, and Access Management telemetry and Master User Records for anomalies and insider threat indicators using User and Entity Behavioral Analytics.
Perform classified network assurance operations up to Top Secret/SCI in designated SCIFs while adhering to compartmented and SAP security constraints.
Coordinate defense priorities in real time with DJOC, USPACOM J6, DCDC, USCYBERCOM, and peer CSSPs.