Junior SOC Analyst (DoD Secret Clearance)

MartinFed•Huntsville, AL

3d•Onsite

About The Position

MartinFed is hiring a Junior SOC Analyst to support the NASA Security Operations Center (SOC). The role monitors, analyzes, categorizes, documents, and reports cybersecurity events and service requests from initial detection through resolution, following NASA standard operating procedures and established service-level timelines. Analysts assess whether reported activity constitutes a cyber incident, analyze potentially malicious emails, apply cybersecurity and networking fundamentals, and determine appropriate responses and escalations. The NASA SOC operates 24/7/365. After completing training, analysts work rotating shifts to support continuous coverage. Standard schedules are four 10-hour shifts, on either Sunday-Wednesday or Wednesday-Saturday, with day, evening, and night shift windows. The position is performed on-site at NASA Marshall Space Flight Center in a fast-paced environment that may involve deadline pressures and extended periods working at a computer or sitting at a desk.

Requirements

U.S. citizenship and an active DoD Secret clearance.
Bachelor's degree.
Two years of directly related cybersecurity experience.
Strong understanding of cybersecurity fundamentals and concepts.
Strong understanding of email analysis and ability to identify potentially malicious or phishing emails.
Understanding of common cyberattack techniques and cybersecurity threats.
General networking knowledge, including TCP/IP, UDP, HTTPS, DNS, and other core protocols.
Demonstrated understanding of Cyber Defense principles.
Ability to recognize, categorize, prioritize, and appropriately escalate potential cybersecurity incidents.
Excellent communication and interpersonal skills.

Nice To Haves

Familiarity with command-line environments across operating systems.
Experience working in a 24/7 security operations center.
Experience with SIEM, EDR, email security, or other cybersecurity monitoring tools.
Familiarity with phishing analysis and indicators of compromise.
Knowledge of basic incident response and cybersecurity investigation processes.
Certifications such as SEC+, CySA+, or GCIH.

Responsibilities

Monitor, triage, document, and report cybersecurity events and incidents from initial detection through final resolution according to NASA procedures and service-level timelines.
Analyze reported cybersecurity events to determine whether they constitute legitimate incidents or require further investigation.
Analyze phishing and potentially malicious emails, including suspicious senders, links, attachments, and indicators of compromise.
Apply knowledge of cyberattack techniques, cybersecurity threats, and Cyber Defense principles to support event triage and escalation.
Submit and track service tickets for the NASA SOC, both internally and with external organizations.
Monitor and log SOC Request/CNOC actions and responses.
Acknowledge SOC service requests in a timely manner and support problem identification, root-cause analysis, escalation, resolution, and closure in accordance with SLAs and OLAs.
Categorize and prioritize cyber events and other SOC service requests using established procedures.
Escalate incidents requiring in-depth analysis to SOC Incident Analysis.
Assist with network investigations of significant cybersecurity incidents and related reporting.
Apply networking knowledge, including TCP/IP, UDP, HTTPS, DNS, and other core protocols, to event analysis and investigations.
Document and track incidents in NASA's authoritative incident management system according to reporting procedures.
Archive and maintain historical SOC data and incident records.
Provide NASA-wide situational awareness about cybersecurity issues affecting the enterprise in accordance with NASA policies and procedures.
Communicate with SOC personnel, customers, and external organizations about cybersecurity events, incidents, and service requests.
Work effectively in a fast-paced, 24/7/365 SOC environment.
After training, work rotating shifts as required for continuous SOC coverage.