Cybersecurity Ops Analyst

SAIC • Flexwork, TN

1d • Remote

About The Position

SAIC is hiring a Cybersecurity Ops Analyst for its Enterprise Security Operations Center (ESOC) Detection & Response team. The role may be performed remotely anywhere in the United States and works either second shift (2 p.m.–midnight) or third shift (10 p.m.–8 a.m. EST) as part of a 24/7/365 operation. The analyst performs advanced, hands-on security event analysis using SIEM and endpoint detection and response (EDR) tools to monitor, investigate, and respond to security events from multiple sources.

The position covers intrusion detection, incident investigation, triage and initial response, threat hunting, and continuous improvement of detection capabilities and response procedures. It requires independent technical judgment in investigating complex security events, documenting findings, and collaborating with other cybersecurity teams, including GRC, architecture, and detection engineering. The analyst also contributes to intelligence gathering and supports the training and development of other analysts.

Requirements

• Bachelor’s degree and at least 2 years of experience, or an associate’s degree in a related discipline and at least 3 years of experience; an additional 4 or more years of experience may be considered in lieu of a degree.
• At least 2 years of cybersecurity operations-related experience.
• Must be a U.S. citizen.
• Must hold Security+ and CySA+ certifications.
• Hands-on experience with SIEM and EDR technologies, including security alert investigation, endpoint analysis, and correlation of security events.
• Experience triaging security incidents, assessing severity and potential impact, and determining appropriate escalation procedures.
• Working knowledge of network security fundamentals and identification of suspicious network activity.
• Working knowledge of Windows, Linux, and cloud environments, including relevant security logs, events, and telemetry.
• Understanding of common attacker tactics, techniques, and procedures (TTPs), including the MITRE ATT&CK framework and its use in security investigations.
• Ability to independently investigate complex or unfamiliar security events, exercise sound technical judgment, and communicate investigative findings.
• Strong written and verbal communication skills, including clear investigation documentation and coordination with technical and nontechnical stakeholders.
• Ability to share technical knowledge effectively and guide less experienced analysts.

Nice To Haves

• Hands-on experience with Splunk Enterprise Security (ES).
• Experience participating in the full incident response lifecycle, including containment, eradication, recovery, and post-incident analysis.
• Experience conducting proactive threat hunts, identifying detection gaps, and contributing to detection tuning and improvements.
• Familiarity with scripting or automation using Python, PowerShell, or similar technologies to support security investigations and operational efficiency.

Responsibilities

• Independently monitor, triage, and investigate security alerts and anomalous activity, determining severity, scope, potential impact, and appropriate response actions.
• Analyze and correlate network, endpoint, system, and cloud telemetry using SIEM and EDR technologies.
• Evaluate suspicious activity, threat intelligence, and vulnerability information to identify potential threats and assess organizational risk.
• Execute approved response actions, including IP, URL, and hash blocks and endpoint isolation; escalate confirmed or suspected incidents to appropriate incident response teams.
• Participate in proactive threat hunting to identify suspicious behavior, indicators of compromise, and potential detection gaps.
• Document investigations, findings, supporting evidence, and response actions accurately and consistently in the incident tracking system.
• Recommend detection tuning, process enhancements, and updates to ESOC procedures and documentation.
• Support onboarding and training of new analysts through knowledge sharing, cross-training, and technical assistance.
• Collaborate with other cybersecurity teams, including GRC, architecture, and detection engineering.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level