Security Operation Center (SOC) Analyst II

General Dynamics Information Technology•Colorado Springs, CO

3d•Onsite

About The Position

The SOC Analyst II provides comprehensive computer network defense and incident response support through 24×7×365 monitoring and analysis of potential threats targeting the enterprise. The role conducts security event monitoring, advanced analytics, and response activities in support of the government’s mission. The analyst applies knowledge of cyber threats, including tactics, techniques, and procedures (TTPs), threat actors, campaigns, and observables, and works with intrusion detection systems, intrusion analysis, SIEM platforms, endpoint threat detection tools, and security operations ticket management. The role supports activities within Special Access Programs (SAPs), as well as day-to-day Collateral, SCI, and SAP activities. It requires strong analytical and technical ability in computer network defense operations, incident handling, threat hunting, malware analysis, event triage and investigation, and incident response. The analyst distinguishes legitimate security incidents from non-incidents, investigates events, implements countermeasures, and uses SIEM or log-management systems for log collection, analysis, correlation, and alerting. This position is onsite in Colorado Springs, Colorado, with 40 scheduled hours per week and 10–25% travel required. A Top Secret/SCI clearance is required to start, and the employee must be able to attain TS/SCI with a CI polygraph.

Requirements

At least 5 years of related experience.
U.S. citizenship required.
Top Secret/SCI clearance required to start; must be able to attain TS/SCI with a CI polygraph.
SAP experience required.
Prior performance in roles such as ISSO or ISSM.
Strong analytical and technical skills in computer network defense operations.
Experience analyzing security events, distinguishing incidents from non-incidents, and conducting triage, investigation, countermeasure implementation, and response.
Hands-on experience with SIEM platforms and/or log-management systems that perform log collection, analysis, correlation, and alerting.
Knowledge of operating systems commonly deployed in enterprise networks, including Windows, OS X, and Linux.
Conceptual understanding of Windows Active Directory.
Working knowledge of network communications and routing protocols, including TCP, UDP, ICMP, BGP, and MPLS.
Working knowledge of common internet applications and standards, including SMTP, DNS, DHCP, SQL, HTTP, and HTTPS.
Experience identifying and implementing countermeasures or mitigating controls for enterprise network deployment.
Experience with one or more of network threat hunting, big data analytics, endpoint threat detection and response, SIEM, workflow and ticketing, or intrusion detection systems.
Bachelor’s degree in a related area, or an associate degree in a related area plus 2 years of experience, or equivalent experience (4 years).
CSSP Analyst or Incident Responder certification required within 6 months of hire; listed certifications include CEH, CFR, CCNA Cyber Ops, CySA+, GCIA, GCIH, GICSP, and SCYBER.

Responsibilities

Provide 24×7×365 monitoring and analysis of potential enterprise threat activity.
Conduct security event monitoring, advanced analytics, and response activities in support of the government’s mission.
Lead incident-handling efforts, including detection, analysis, and triage.
Perform threat hunting, anomalous-pattern detection, content management, and malware analysis.
Analyze security events to determine whether they qualify as legitimate security incidents.
Conduct event triage and incident investigation, implement countermeasures, and perform incident response.
Use SIEM platforms and/or log-management systems for log collection, analysis, correlation, and alerting.
Analyze Windows event logs, network traffic, and IDS events for malicious intent.
Track activities within security operations workflows.
Identify and implement countermeasures or mitigating controls for deployment in the enterprise network environment.
Support Collateral, SCI, and SAP activities.