Cybersecurity Ops Analyst (Shift Lead)

SAIC•Oak Ridge, TN

2d•Remote

About The Position

SAIC is hiring a Cybersecurity Ops Analyst (Shift Leader) for its 24/7/365 Security Operations Center Detection & Response team. The role leads advanced security event analysis, monitors events from multiple sources using a SIEM, and oversees Cybersecurity Ops Associates. The position is located in Oak Ridge, Tennessee, and SAIC is open to remote work anywhere in the United States. Alongside incident response, the Shift Leader manages shift operations, including approving timecards and expenses, providing daily training, tracking performance, and ensuring shift coverage. The role also participates in threat hunting and intelligence gathering and works to improve ESOC procedures and processes.

Requirements

Bachelor's degree and 2 or more years of experience, or an associate degree in a related discipline and 3 or more years of experience; an additional 4 or more years of experience may be considered in lieu of a degree.
At least 2 years of cybersecurity operations-related experience.
Security+ and CySA+ certifications.
Strong leadership skills and proven ability to lead and motivate a team effectively.
Can-do attitude.
Self-motivated and quick to learn.
Excellent verbal and written communication skills.
Ability to multitask and collaborate to solve complex technical problems.
Must be a U.S. citizen.

Nice To Haves

3 or more years of cybersecurity operations-related experience.
One or more of the following certifications: GCIH, CASP+, GSEC, or other relevant certifications.
Experience with SIEM tools, antivirus, and IDS/IPS technologies.

Responsibilities

Lead identification, prioritization, and response to intrusion activity and anomalous behavior on a 24/7/365 Detection & Response team.
Assess the impact of potentially malicious traffic on the network and infrastructure.
Analyze security anomalies and incidents using network forensics via a SIEM and host-level forensics via an EDR tool.
Document shift incidents and maintain incident tickets.
Communicate and escalate issues and incidents as necessary.
Handle IP, URL, and hash block requests and develop new correlation content.
Conduct second-level real-time monitoring and analysis of security alerts.
Delegate event analysis tasks to Cybersecurity Ops Associates as required.
Provide feedback on tuning to enhance anomaly detection.
Retrieve and review data files associated with security events.
Evaluate malicious activity and review vulnerability information to assess risk.
Collaborate with other teams to resolve incidents.
Manage shift operations, including training, mentoring, and overseeing Cybersecurity Ops Associates; approving timecards and expenses; providing feedback; writing performance reviews; and ensuring shift coverage.
Review and improve documentation procedures.
Participate in knowledge sharing.
Participate in threat hunting and intelligence gathering.