Security Operation Center (SOC) Analyst II

Amatriot Group • Colorado Springs, CO

1d • Onsite

About The Position

This position provides comprehensive Computer Network Defense and Response support through 24x7x365 monitoring and analysis of potential threat activity targeting the enterprise. The role involves conducting security event monitoring, advanced analytics, and response activities in support of the government's mission. A solid understanding of cyber threats and information security, including TTPs, Threat Actors, Campaigns, and Observables, is required. Familiarity with intrusion detection systems, intrusion analysis, security information event management platforms, endpoint threat detection tools, and security operations ticket management is essential. This position supports activities within Special Access Programs (SAPs) for Department of Defense (DoD) agencies and provides day-to-day support for Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities.

Requirements

• 5-7 years related experience
• Prior performance in roles such as ISSO or ISSM
• SAP experience
• Active TS/SCI clearance (Must be able to obtain a CI Poly)
• Strong analytical and technical skills in computer network defense operations
• Ability to lead efforts in Incident Handling (Detection, Analysis, Triage)
• Ability to lead efforts in Hunting (anomalous pattern detection and content management)
• Ability to lead efforts in Malware Analysis
• Experience and ability with analyzing information technology security events to discern events that qualify as legitimate security incidents as opposed to non-incidents.
• Must be knowledgeable and have hands-on experience with a Security Information and Event Monitoring (SIEM) platforms and/or log management systems that perform log collection, analysis, correlation, and alerting
• Strong logical/critical thinking abilities, especially analyzing security events (windows event logs, network traffic, IDS events for malicious intent)
• Excellent organizational and attention to details in tracking activities within various Security Operation workflows
• A working knowledge of the various operating systems (e.g. Windows, OS X, Linux, etc.) commonly deployed in enterprise networks
• A conceptual understanding of Windows Active Directory is also required
• A working knowledge of network communications and routing protocols (e.g. TCP, UDP, ICMP, BGP, MPLS, etc.) and common internet applications and standards (e.g. SMTP, DNS, DHCP, SQL, HTTP, HTTPS, etc.)
• Experience with the identification and implementation of counter-measures or mitigating controls for deployment and implementation in the enterprise network environment
• Experience with one or more of the following technologies: Network Threat Hunting, Big Data Analytics, Endpoint Threat Detection and Response, SIEM, workflow and ticketing, and Intrusion Detection System

Nice To Haves

• Required Certifications: CSSP Analyst or CSSP Auditor or CSSP Incident Responder Cert
• Certified Ethical Hacker (CEH)
• Certified Information Systems Auditor (CISA)
• Cisco Cybersecurity Specialist (SCYBER)
• CompTIA Cloud+ CE
• CompTIA Cybersecurity Analyst (CySA+)
• Computer Hacking Forensic Investigator (CHFI)
• CyberSec First Responder (CFR)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Incident Handler Certification (GCIH)
• GIAC Certified Intrusion Analyst Certification (GCIA)
• GIAC Certified Systems and Network Auditor (GSNA)
• Global Industrial Cyber Security Professional (GICSP)

Responsibilities

• Provide comprehensive Computer Network Defense and Response support through 24x7x365 monitoring and analysis of potential threat activity.
• Conduct security event monitoring, advanced analytics, and response activities.
• Analyze information technology security events to discern legitimate security incidents from non-incidents.
• Perform security event triage, incident investigation, implementing countermeasures, and conducting incident response.
• Utilize Security Information and Event Monitoring (SIEM) platforms and/or log management systems for log collection, analysis, correlation, and alerting.
• Analyze security events (Windows event logs, network traffic, IDS events) for malicious intent.
• Track activities within various Security Operation workflows with attention to detail.
• Identify and implement countermeasures or mitigating controls for deployment in the enterprise network environment.
• Engage in Network Threat Hunting, Big Data Analytics, Endpoint Threat Detection and Response, SIEM, workflow and ticketing, and Intrusion Detection System activities.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed