Cyber Real-Time Analyst

Quantum Sky•Miami Springs, FL

10d•$95,000 - $120,000•Onsite

About The Position

Quantum Sky is hiring a Cyber Real-Time Analyst for its Network Assurance and Defensive Cyber Operations team supporting DISA Pacific at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The position supports a 24/7/365 watch cell defending the Department of Defense Information Network, U.S. Pacific Command, and mission partner enclaves against cyber threats. The analyst performs real-time boundary intrusion detection, cross-enclave incident response, and security monitoring across Unclassified, Secret, and Top Secret/SCI environments, including specialized compartments. The role also defends boundary infrastructure and regional mission networks, including the PACOM Mission Network and Joint Operational Edge – Coalition Environment. The analyst monitors and investigates security events, correlates network and endpoint data, conducts SIEM analysis, tunes and recommends defensive tools and detection measures, and documents and escalates incidents under DoD reporting requirements. The role includes coordination with mission partners and operational commands, monitoring identity and access telemetry, and conducting classified operations in designated SCIFs. Work is on-site and requires rotating 10-hour shifts covering days, nights, weekends, and holidays.

Requirements

For Level II: Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related discipline and 2+ years of relevant CND experience; or an Associate degree and 4+ years; or 6+ years of relevant experience or military service in lieu of a degree.
For Level III: Bachelor’s degree and 4+ years of relevant experience; or an Associate degree and 6+ years; or 8+ years of relevant experience or military service in lieu of a degree.
Before starting, hold a valid certification or related degree meeting DoD 8140.03/DCWF Work Role Code 531 (Cyber Defense Analyst - CSSP) at the Intermediate Proficiency Level. Accepted certifications include CySA+, CCNA-Security, GICSP, GSEC, Security+ CE, CND, CEH, or higher certifications such as CASP+ CE, CISSP, GCIA, or GCIH.
Proven experience in a SOC performing live alert triage, event correlation, and intrusion analysis.
Solid understanding of TCP/IP, DNS, BGP, and HTTP/S, and network architecture inspection using tools such as Wireshark, TCPdump, and NetFlow.
Hands-on familiarity with SIEM querying and dashboard creation using Elastic KQL or Microsoft KQL.
Ability and willingness to work rotating 10-hour shifts covering days, nights, weekends, and holidays, on-site at Ford Island, Hawaii.
Must be a U.S. citizen.
Active Top Secret clearance with eligibility to obtain SCI access upon start, with a Tier 5/SSBI investigation within scope. Candidates with an active Secret clearance may be considered if Top Secret/SCI processing begins immediately upon hire with government approval.

Nice To Haves

Direct experience monitoring DISA boundary systems such as IAP, BCAP, ERS, or Thunderdome ZTNA.
Working knowledge of the MITRE ATT&CK framework and its operational application to detection engineering and rule mapping.
Hands-on experience defending hybrid cloud architectures, including Azure Gov/IL-6, AWS GovCloud, or JWCC.
Familiarity with endpoint detection telemetry, including Microsoft Defender for Endpoint/Server, EndGuard, or Sysmon.
Prior experience with JIRA ticket workflows and DoD incident reporting tools such as Rally.
Ability to use AI tools such as Gemini, Grok, or ChatGPT to automate repetitive triage workflows or author custom detection playbooks.

Responsibilities

Monitor and analyze intrusions, events, and vulnerabilities across DISA enterprise boundaries, including Internet Access Points, Boundary Cloud Access Points, Enterprise Recursive Services, and releasable/federal DODIN DMZs.
Correlate network alerts, NetFlow, packet captures, Deep Packet Inspection, Deep File Inspection, Anomaly Based Protection, and IDS/IPS logs to confirm or refute intrusion attempts.
Use and recommend tuning of boundary cyber defense platforms, including Cisco FirePOWER, Next Generation Sensors, Arbor, Guardian, Web Content Filtering, Cloud-Based Internet Isolation, and BIND9 DNS security.
Maintain incident records in the DoD-mandated reporting structure and author Situational Awareness Reports and Tippers in accordance with CJCSM 6510.01F timelines.
Conduct security analytics using Splunk, Microsoft Sentinel/Azure Lighthouse, and Elastic Stack.
Correlate endpoint telemetry and identity logs with perimeter alerts to establish attack kill chains across Zero Trust pillars.
Recommend detection signatures, tuning, and countermeasures for emerging threats and web exploits, and coordinate rapid de-confliction.
Provide cyber defense support to CSSP subscribers, hosted data centers, and enterprise cloud enclaves.
Conduct cybersecurity operations on the PACOM Mission Network and Joint Operational Edge – Coalition Environment architectures at DISA PAC.
Monitor ICAM telemetry and Master User Records for anomalies and insider-threat indicators using User and Entity Behavioral Analytics.
Conduct classified network assurance operations up to Top Secret/SCI in designated SCIFs while adhering to compartmented and SAP security constraints.
Coordinate defense priorities with the DISA Joint Operations Center, USPACOM J6, DoD Cyber Defense Command, USCYBERCOM, and peer CSSPs.