Cyber Triage Analyst Level II

Argo Cyber Systems•Arlington, VA

31d•$75,000 - $95,000

About The Position

Argo Cyber Systems, LLC is seeking an experienced JCDC Cyber Triage Analyst to provide frontline cyber defense support to the Joint Cyber Defense Collaborative (JCDC) under the Engagement Support Services (ESS) program. The analyst performs initial analysis and triage of cyber threat reports, indicators of compromise (IOCs), incident notifications, and other cybersecurity information submitted to the JCDC. This is not an entry-level or developmental position; the role is comparable to a Tier 1/Tier 2 SOC Analyst with enhanced Cyber Threat Intelligence responsibilities. The analyst independently researches cyber activity, evaluates technical information, develops defensible analytical conclusions, identifies intelligence and information gaps, and recommends follow-on actions. The position supports secure, cloud-based capabilities for cyber incident response, threat hunting, and national-level cybersecurity operations. It involves coordination with government organizations, private-sector partners, critical infrastructure stakeholders, and other cybersecurity professionals. Candidates must be U.S. citizens, hold an active TS/SCI clearance, and be able to obtain and maintain DHS Suitability.

Requirements

U.S. citizenship.
Active TS/SCI security clearance.
Ability to obtain and maintain DHS Suitability.
2–4+ years of progressive cybersecurity experience supporting SOC operations, Cyber Threat Intelligence, cyber incident response, network security monitoring, threat hunting, or cybersecurity operations.
Demonstrated ability to independently triage and analyze cybersecurity incidents, alerts, threat reports, or intelligence.
Experience analyzing technical indicators such as IP addresses, domains, URLs, file hashes, network traffic, and malware-related artifacts.
Experience researching and enriching IOCs using threat intelligence and OSINT resources.
Ability to assess the severity, credibility, and potential impact of cyber threats.
Ability to document analytical findings and develop concise, actionable recommendations.
Strong technical research and analytical reasoning skills.
Strong written and verbal communication skills.
Ability to work effectively with government personnel, technical analysts, incident responders, intelligence professionals, and partner organizations.
Ability to collaborate across geographically distributed teams and physical locations.
A bachelor's degree from an accredited college or university in cybersecurity, computer science, computer engineering, information technology, information systems, network engineering, or another related technical discipline; alternatively, a high school diploma or equivalent plus at least four additional years of directly relevant technical cybersecurity experience.

Nice To Haves

Previous cybersecurity experience supporting CISA, FBI, NSA, DoD, DHS, or another federal cybersecurity or intelligence organization.
Understanding of the National Cyber Incident Scoring System (NCISS) and its application to incident prioritization and triage.
Knowledge of common cyberattack lifecycle stages, including reconnaissance and footprinting, scanning and enumeration, initial access, privilege escalation, persistence, network exploitation and lateral movement, command and control, defense evasion, and covering tracks.
Ability to recognize and categorize cybersecurity vulnerabilities and associated attack techniques.
Knowledge of Computer Network Defense (CND) policies, procedures, processes, and regulations.
Understanding of operational threat environments, from opportunistic attackers and cybercriminal organizations to sophisticated nation-state actors.
Knowledge of system and application security threats and vulnerabilities, including buffer overflows, cross-site scripting (XSS), SQL/PL-SQL and other injection attacks, malicious or mobile code, race conditions, covert channels, replay attacks, return-oriented programming/attacks, and other common application and network exploitation techniques.
Experience with SIEM platforms, Threat Intelligence Platforms (TIPs), case management systems, and cybersecurity ticketing platforms.
Familiarity with cyber threat intelligence concepts, adversary TTPs, and IOC lifecycle management.
Knowledge of U.S. critical infrastructure sectors and associated cyber risks.
Familiarity with DHS/CISA cybersecurity products, services, alerts, advisories, and operational processes.
Experience in an operational SOC, watch floor, incident response center, or cyber fusion environment.
One or more preferred certifications: CompTIA Security+, CompTIA CySA+, GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Cyber Threat Intelligence (GCTI), or comparable cybersecurity, incident response, SOC, or threat intelligence certifications.

Responsibilities

Perform initial triage and assessment of incoming cyber threat tickets, incident reports, IOC submissions, and cybersecurity notifications.
Analyze technical indicators and artifacts, including IP addresses, domain names, URLs, file hashes, network traffic patterns, malware artifacts, and related telemetry.
Assess the credibility, severity, scope, and potential operational impact of reported cyber activity.
Evaluate potential impacts to federal networks and U.S. critical infrastructure sectors.
Enrich IOCs using Threat Intelligence Platforms (TIPs), OSINT resources, commercial intelligence sources, and authorized government-exclusive resources.
Correlate indicators with known threat actors, campaigns, malware families, vulnerabilities, tactics, techniques, and procedures (TTPs).
Develop concise, defensible cyber triage reports with analytical findings and actionable recommendations.
Determine when incidents or threat activity require escalation or additional technical analysis.
Route tickets and analytical findings to appropriate JCDC teams, CISA organizations, or interagency partners.
Coordinate with sector-specific analysts, incident responders, threat hunters, intelligence analysts, and interagency liaisons to obtain additional technical and operational context.
Maintain complete and accurate documentation in ticketing, case management, and knowledge management systems.
Participate in operational shift handoffs and daily cybersecurity briefings.
Monitor emerging cyber threat campaigns, adversary activity, vulnerabilities, and trends.
Support development and continuous improvement of cyber triage playbooks, workflows, and Standard Operating Procedures (SOPs).
Provide feedback to submitters and partner organizations regarding ticket status, findings, and disposition.
Support collaboration across geographically distributed government and contractor teams.