Level 2 Cyber Security Analyst

Netrio•McKinney, TX

About The Position

The SOC Analyst II is a mid-level, hands-on investigative role in Netrio's Government SOC. The analyst performs in-depth security investigations and incident response, serves as the primary escalation point for confirmed or suspected incidents across federal and Defense Industrial Base (DIB) client environments hosted in government-authorized cloud platforms, and mentors Tier 1 analysts. The role aligns to the DoD 8140/DCWF Cyber Defense Analyst (511) work role at an intermediate proficiency level. The position supports incident handling and reporting, threat hunting, detection and playbook improvement, client coordination, evidence handling, and audit and assessment readiness. It also supports endpoint management and email security investigations when they intersect with broader incidents. The job is part of a 24/7 operational function, with rotating shifts and on-call response requirements.

Requirements

2–5 years of experience in a SOC analyst, incident response, or threat hunting role.
Production experience with at least one SIEM/XDR platform and one EDR platform.
Solid understanding of the cyber kill chain, MITRE ATT&CK framework, and common adversary TTPs.
Experience with log analysis, network traffic analysis, and basic malware/artifact triage.
Strong incident documentation and client communication skills, including under time pressure.
U.S. citizenship, required for access to government client environments.
Ability to pass a background investigation as required by client contracts.
CompTIA CySA+ and/or GIAC GCIH (Certified Incident Handler); if not held at hire, required certification(s) must be obtained within the first 6 months of employment as a condition of continued assignment to government client accounts.
Ability to work rotating shifts, including nights, weekends, and holidays.
Ability to respond to off-hours pages and alerts during an on-call rotation.
Reliable attendance and shift punctuality.
Ability to spend extended periods at a workstation monitoring multiple screens, dashboards, and investigation tooling.

Nice To Haves

GIAC GCFA (Certified Forensic Analyst), especially for candidates focused on investigation/forensics depth.
Prior experience supporting CMMC, FedRAMP, or NIST 800-171/800-53 controlled environments.
Experience in a multi-tenant MSSP or managed detection and response (MDR) setting.
Scripting or automation experience with PowerShell or Python for detection engineering or response automation.
Familiarity with government cloud administrative constructs such as GCC High or Azure Government, or equivalent.
Experience mentoring or leading junior analysts.

Responsibilities

Investigate escalated alerts and incidents using SIEM/XDR and EDR platforms.
Conduct root-cause analysis, threat correlation, and impact assessment across multi-tenant government client environments.
Lead containment, eradication, and recovery actions for confirmed incidents according to incident response playbooks.
Own the DFARS 252.204-7012 incident reporting workflow, including coordination of 72-hour DIBNet reporting and 90-day data preservation requirements.
Conduct threat hunting across EDR, SIEM, and identity telemetry, including conditional access alerts and sign-in logs.
Mentor Tier 1 analysts, validate their escalations, provide on-shift coaching, and review the quality of their triage decisions.
Refine and author detection use cases, correlation rules, and playbooks based on investigation findings.
Coordinate with client points of contact during active incidents within defined communication protocols.
Support endpoint management (RMM) and email security investigations when they intersect with broader incidents.
Maintain and validate chain-of-custody and evidence-handling procedures for CUI-related investigations under CMMC Level 2 / NIST SP 800-171.
Participate in tabletop exercises, incident response plan reviews, and audit/assessment support, including C3PAO readiness activities.
Respond to off-hours pages and alerts during the on-call rotation, including leading responses to active incidents outside normal working hours.