Security Operations Analyst

Astraeus Operations LLC•, VA

2d•$170,000 - $175,000•Onsite

About The Position

The Security Operations Analyst provides on-site, 24/7/365 Tier 1 security monitoring, event analysis, and incident triage for Google Public Sector’s sovereign, classified, and controlled environments. Initial support covers Google Distributed Cloud (GDC) Air-Gapped security fabrics and Controlled Unclassified Information (CUI) domains, with scope designed to scale across current and future Google sovereign infrastructure, appliances, and air-gapped offerings. The analyst monitors SIEM and EDR alerts, enriches and correlates events for high-confidence triage, and retains end-to-end alert ownership, customer communication, and incident documentation in coordination with SecOps Managers and Google SecOps engineering. The position is based on-site in Tysons Corner, Virginia, and supports continuous operations, including overnight, weekend, and holiday shifts. The analyst also supports accreditation activities, evaluates detection and playbook effectiveness, contributes recommendations for tuning and process improvements, and maintains incident, shift, and weekly activity records.

Requirements

At least 3 years of experience in security operations (SOC), cybersecurity, or systems administration.
Hands-on experience with SIEM, IDS, EDR, and case-management or ticketing tools.
Technical experience supporting Windows and Linux operating systems, networking infrastructure, scripting, and security-application troubleshooting.
Possess and maintain an active DoD 8140 Cyber Defense Analyst (CSSP Analyst) role-qualifying certification, such as CySA+, GCIA, GCIH, CEH, or CISSP.
Successfully complete Google’s extended workforce onboarding process and maintain required government-contract compliance, including mandatory training.
Active TS/SCI with Full Scope Polygraph.
Successfully pass background and drug screening.
Ability to communicate clearly in writing and verbally with customers, teammates, and engineering teams, translating technical findings into concise updates, diagnostic summaries, and incident reports.
Ability to collaborate in classified, mission-critical environments, protect sensitive information, and follow security procedures, approved runbooks, and escalation protocols.
Disciplined documentation and time management, including maintaining accurate incident and shift records, prioritizing alerts by severity, meeting response timelines, and adapting to changing mission needs.
Strong analytical and investigative skills to interpret SIEM/EDR alerts, correlate events and security telemetry, identify indicators of compromise, assess severity and operational impact, develop evidence-based incident dispositions, and recommend response actions or escalation.
Ability to retain incident ownership during technical consults, track follow-on actions, and maintain customer updates in coordination with SecOps Managers and Google SecOps.
Ability to evaluate detection effectiveness and investigative workflows, identify noisy alerts and playbook gaps, and develop practical recommendations for alert tuning, playbook improvement, and operational process enhancement.
Ability to support a 24/7/365 operation, including overnight, weekend, and holiday shifts, while coordinating room coverage and providing structured, timely shift handoffs.

Nice To Haves

Bachelor’s degree in cybersecurity or computer science, or equivalent practical experience.
Experience in a dedicated SOC, including event analysis using Splunk, ELK, or other SIEM systems.
Hands-on security-detection development and alert tuning in partnership with Tier 2 and Tier 3 engineering teams.
Experience compiling threat reports that translate complex indicators of compromise into narrative overviews.
Advanced understanding of LAN/WAN topologies, Google Cloud Platform, Kubernetes, and air-gapped computing environments.
Experience operating in classified SCIF environments, handling sensitive or classified data, or supporting cloud environments.
Elastic Certified SIEM Analyst or Splunk Core Certified User certification.
General knowledge of network analysis, vulnerability scanning (such as Nessus), security-hardening best practices (such as DISA STIG), and vulnerability landscapes (such as OWASP Top 10).
Foundational understanding of LAN/WAN topologies, Kubernetes, and air-gapped computing environments.

Responsibilities

Monitor GDC Air-Gapped security fabrics and CUI domains using Google Managed SecOps tools; analyze events in Splunk, ELK, designated SIEM systems, and EDR tools.
Provide initial GPS customer and incident-reporting support through email and support portals, acknowledging alerts within 5 minutes and delivering a First Meaningful Response within 15 minutes for High/Critical alerts and 25 minutes for all others.
Collect and analyze event descriptions, affected-system details, security telemetry, and related evidence; assess severity and operational impact, correlate events, and develop evidence-based disposition recommendations.
Escalate confirmed threats to the appropriate Google SecOps representative in accordance with established procedures and runbooks.
Own and actively manage ServiceNow incidents and investigations, including analysis, customer updates, follow-on actions, and required government incident-report drafts.
Transfer incident ownership only with explicit Google manager approval; coordinate incident response and required EDR tooling with Google SecOps.
Before Google on-call consults, evaluate observed activity, playbook and investigative query results, indicators of compromise, and supporting technical evidence to develop proposed dispositions and recommended next steps.
Document active High/Critical shift handoffs, including current status, completed analysis, findings, and recommended next steps; immediately accept incoming incidents without rejection.
Provide hands-on-keyboard accreditation support to demonstrate and validate playbooks, runbooks, IT infrastructure, and Data Center operations.
Evaluate alert effectiveness and playbook performance, identify detection or workflow gaps, and develop tuning and process-improvement recommendations.
Support continuous coverage during holidays and severe or inclement weather, coordinating with teammates to keep at least one FTE in each occupied SecOps room.
Answer and route SecOps calls, seek on-call guidance as needed, and respond to SecOps virtual communications within 15 minutes.
When designated live Queue Manager, monitor alert timers and intervene at least 5 minutes before response targets expire.
As designated senior analyst, pre-screen off-hours consults for next-business-day Manager review.
Participate in requested customer situational-awareness calls; assess reported information for security and operational significance, identify potential impacts requiring further investigation or response, and communicate findings and tasking through designated channels.
Maintain records and provide weekly activity report inputs, including alert-response SLA compliance, triage dispositions, playbooks validated or updated, noisy alerts and tuning recommendations, work-item quality flag trends, and shift staffing.
Perform other duties as assigned.