Cyber Security Operations Specialist II/Tier 2

CACI International•St. Louis, MO

1d•$63,300 - $129,700

About The Position

CACI supports and secures National Geospatial-Intelligence Agency (NGA) enterprise networks through its Transport & Cybersecurity Services (TCS) program, delivering cybersecurity and IT infrastructure services for the U.S. Department of War and Intelligence Community. TCS provides design, engineering, procurement, implementation, operations, sustainment, and disposal of transport and cybersecurity IT resources across multiple networks, security domains, and locations worldwide. The Cyber Security Operations Specialist II/Tier 2 serves as a Tier 2 Cyber Defense Analyst for NGA networks, bridging initial triage and advanced incident response. The position conducts detailed correlation and analysis of cyber events, uses advanced security tools to gather evidence, and carries out response actions to defend against adversary activity. The role operates in a 24x7x365 Cyber Security Operations Center (CSOC), mentors junior analysts, and works with senior incident responders to escalate and address complex threats. It also supports tabletop exercises, simulations, and major Cyber Incident Response operations. The position requires an active TS/SCI clearance to start and the ability to obtain a CI Poly within six months of hire. The employee must be able to work one of five shifts, either eight hours on weekdays or 12 hours on weekends, and be ready to relocate to a designated Continuity of Operations (COOP) site during exercises or crises. Travel may be up to 10%, locally. The proposed salary range is $63,300–$129,700.

Requirements

U.S. citizenship.
Active TS/SCI clearance at the start of work; must obtain a CI Poly within six months of hire.
Typically a BA/BS degree or equivalent experience, and at least four years of related work experience.
Current certifications compliant with DoD 8140.03 and the DoD 8570.01-M IAT Level II and CSSP Analyst baseline certification lists.
Ability to work one of five shifts: eight-hour weekday shifts or 12-hour weekend shifts.

Nice To Haves

DoD 8570 IAT Level III certification.
Active TS/SCI clearance based on a counterintelligence (CI) poly.
Five or more years of related CSOC Tier 2 or Tier 3 work experience.

Responsibilities

Lead investigations into escalated cyber events and build case files that characterize the nature, scope, and potential threat of activity.
Use advanced queries in SIEM platforms such as Splunk, Elastic, and Microsoft Sentinel to analyze and correlate complex log data.
Track Malicious Cyber Actor intrusion sets using current threat intelligence and identify related Indicators of Compromise in the enterprise environment.
Perform appropriate response actions and meticulously document findings in the IT service management system.
Identify network activity indicative of potential insider threats and escalate it to the agency’s counterintelligence element.
Evaluate events and recommend incident categorization in accordance with CJCSM 6510.01B criteria.
Develop and apply knowledge of enterprise network architecture and security-device placement to contextualize anomalous traffic and strengthen network defense.
Serve on the Cyber Incident Response Team during major declared incidents, working with other cyber organizations.
Maintain readiness to relocate to a designated COOP site during exercises or real-world crises to sustain CSOC operations.
Mentor junior analysts and collaborate with senior incident responders.
Participate in tabletop exercises, simulations, and major Cyber Incident Response operations.