Cyber Security Operations Analyst II

Bigbear.ai•UNAVAILABLE, UNAVAILABLE

21h

About The Position

BigBear.ai is seeking a Cybersecurity Operations Analyst to join their team. In this role, you will serve as the primary escalation point for security alerts, incidents, and threat investigations. You will analyze, contain, and remediate security events, working closely with IT and business teams to protect systems, data, and users. As part of a small team, you will have the opportunity to own multiple aspects of security operations, including monitoring security systems, responding to events, refining detection processes, and driving continuous improvements to defensive capabilities. This is a chance to make a real impact and mature the security operations program.

Requirements

8+ years of experience in security operations, incident response, or related field.
Hands-on experience with SIEM, EDR, and network security tools.
Strong understanding of threat actors, attack techniques (MITRE ATT&CK), and incident response best practices.
Ability to analyze logs, packets, and system behavior to detect and investigate malicious activity.
Excellent written and verbal communication skills.

Nice To Haves

Experience in a small-team environment with cross-functional responsibilities.
Familiarity with cloud security monitoring (AWS, Azure, or GCP).
Industry certifications such as Security+, CySA+, GCIH, GCIA, or similar.
Scripting skills (Python, PowerShell, or Bash) for automation.

Responsibilities

Monitor and triage alerts from SIEM, EDR, email security, and other monitoring tools.
Investigate escalated alerts from MSSP or automated detections.
Perform threat hunting based on IOCs, suspicious activity, and threat intelligence.
Lead response for medium-to-high severity incidents.
Conduct root cause analysis and document findings in post-incident reports.
Coordinate with internal teams to contain and eradicate threats.
Tune and maintain SIEM, EDR, and other security platforms to improve detection fidelity.
Develop custom detection rules, dashboards, and reports.
Lead the lifecycle of vulnerability management, from scanning and analysis to remediation tracking.
Validate and prioritize vulnerabilities based on their exploitability and potential impact to business operations.
Work directly with IT teams to provide guidance and technical recommendations for patching and configuration changes.
Track remediation efforts to ensure vulnerabilities are addressed in a timely manner.
Act as a liaison between security operations and IT/business units.
Provide technical guidance to Tier 1 analysts.
Communicate security findings and recommended actions to stakeholders in clear, non-technical language.
Recommend and implement process and tooling enhancements.
Maintain and refine incident response runbooks and escalation procedures.