Cybersecurity Triage Analyst

MANTECH•Lorton, VA

7h•$91,600 - $153,800•Onsite

About The Position

MANTECH is seeking a motivated, career and customer-oriented Cybersecurity Triage Analyst to join our team in Lorton, VA. As a SOC Cybersecurity Triage Analyst, you will be responsible for providing full-time support to a large enterprise Department of Defense customer. The core responsibility is to conduct initial triage and analysis of cyber threat reports and alerts to protect infrastructure and data. This role involves monitoring alert queues for sensitive assets and known attacker campaigns, performing automated and manual remediation of adverse events, and ensuring the health of signal ingestion across Microsoft and third-party tools. The Analyst will work closely with other teams to escalate incidents and recommend improvements to response techniques and automation playbook.

Requirements

Bachelor’s degree and at least 2 years of hands-on experience in security operations, incident response, or cybersecurity threat management. An additional 2 years of experience may be substituted in lieu of a degree.
Current DoD 8570/8140 IAT Level 2 certification
Fundamental experience and proficiency with querying languages (KQL, SQL, SPL, etc.).
Knowledge and/or experience protecting network environments against external and insider threats.
Experience completing and analyzing SCAP Vulnerability scans.
Familiarity with Common Vulnerabilities and Exposures (CVE) tracking and remediation.
Fundamental understanding of security in cloud environments (e.g. Azure, AWS, GCP, Oracle).
Must have an current/active Top-Secret Clearance with SCI Eligibility.

Nice To Haves

Fundamental understanding of advanced persistent threats (APT) and associated tactics, attack frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain), credential compromise techniques, technology and security principles, and knowledge of the cyber threat landscape.
Knowledge or experience with Splunk Enterprise, HBSS, ACAS, Microsoft Sentinel, or similar tools.
Hands-on experience with SIEM, SOAR, XDR, and/or enterprise vulnerability management tools.
CSSP Analyst Certifications highly desired (Ex. GCIA, GCIH, Cloud+, CEH)

Responsibilities

Alert Prioritization and Triage: Focuses on the monitoring, initial triage, managing, and reviewing incidents to assess their urgency, and escalating incidents if necessary.
Signal Ingestion Health: Monitors and diagnoses the health of signal ingestion to ensure that alerts are properly received and processed.
Daily Security Checks: Performs daily checks of security tools to maintain the health and functionality of security tools.
Incident Investigation, Response, and Remediation: Conducts and participates in initial investigation, incident response, remediation, and documentation of security incidents and enforces cybersecurity policies/SOPs.
Root-Cause Analysis and Escalation: Performs initial root-cause analysis to reconcile technical details (5Ws) obtained from various sources. Escalates incidents for advanced investigation and remediation for more complex issues.
Triage analysts may be involved in various investigation types including malicious adversarial actions, common IOC remediation, Insider Threat Inquiries.