Security Operation Center (SOC) Analyst II

General Dynamics Information Technology•Colorado Springs, CO

5d•$112,840 - $137,310•Onsite

About The Position

The SOC Analyst provides comprehensive Computer Network Defense and Response support through 24×7×365 monitoring and analysis of potential threats targeting the enterprise. The role conducts security event monitoring, advanced analytics, and response activities in support of the government’s mission. It requires understanding cyber threats and information security concepts, including TTPs, threat actors, campaigns, and observables, as well as familiarity with intrusion detection and analysis, SIEM platforms, endpoint threat detection tools, and security operations ticket management. The position supports Special Access Programs (SAPs) and provides day-to-day support for Collateral, SCI, and SAP activities. The analyst leads or supports incident handling, threat hunting, and malware analysis; evaluates security events to distinguish legitimate incidents from non-incidents; investigates incidents and implements countermeasures; and uses SIEM or log-management systems for collection, analysis, correlation, and alerting. The work is onsite in Colorado Springs, Colorado, with 40 scheduled weekly hours and 10–25% travel required. A TS/SCI clearance is required to start, and the candidate must be able to attain TS/SCI with CI polygraph.

Requirements

At least 5 years of related experience.
Prior performance in roles such as ISSO or ISSM.
SAP experience.
Strong analytical and technical skills in computer network defense operations.
Hands-on experience with SIEM platforms and/or log-management systems.
Strong logical and critical-thinking abilities, including analysis of Windows event logs, network traffic, and IDS events for malicious intent.
Working knowledge of enterprise operating systems such as Windows, OS X, and Linux.
Conceptual understanding of Windows Active Directory.
Working knowledge of network communications and routing protocols, including TCP, UDP, ICMP, BGP, and MPLS, and common internet applications and standards such as SMTP, DNS, DHCP, SQL, HTTP, and HTTPS.
Experience with one or more of network threat hunting, big data analytics, endpoint threat detection and response, SIEM, workflow and ticketing, or intrusion detection systems.
Bachelor’s degree in a related area, or an Associate’s degree in a related area plus 2 years’ experience, or equivalent experience (4 years).
CSSP Analyst or Incident Responder certification within 6 months of hire; listed examples include CEH, CFR, CCNA Cyber Ops, CySA+, GCIA, GCIH, GICSP, and SCYBER.
U.S. citizenship.
Must currently possess TS/SCI clearance and be able to attain TS/SCI with CI polygraph.

Responsibilities

Monitor and analyze potential threat activity targeting the enterprise through 24×7×365 Computer Network Defense and Response operations.
Conduct security event monitoring, advanced analytics, and response activities in support of the government’s mission.
Lead or contribute to incident handling, including detection, analysis, and triage.
Conduct threat hunting, anomalous-pattern detection, content management, and malware analysis.
Analyze security events to identify legitimate incidents, investigate them, implement countermeasures, and conduct incident response.
Use SIEM platforms or log-management systems to collect, analyze, correlate, and alert on logs.
Track activities across security operations workflows with strong organization and attention to detail.
Identify and implement countermeasures or mitigating controls for deployment in the enterprise network environment.
Provide day-to-day support for Collateral, SCI, and SAP activities.