Security Operations Center Analyst - Mid

Koniag Government Services•Washington, DC

1d•Onsite

About The Position

Koniag Operations Services, LLC (KOS), a Koniag Government Services company, is seeking a Mid-Level Security Operations Center (SOC) Analyst to support the U.S. Small Business Administration (SBA) in Washington, DC. The position requires the ability to obtain and maintain a Public Trust. The analyst will monitor, detect, analyze, and support responses to cybersecurity threats affecting SBA’s enterprise IT environment, working under the guidance of the Cybersecurity Operations Technical Lead and Senior Cyber Defense Analysts. The analyst will contribute to day-to-day SOC operations, including event monitoring and triage, incident investigation and response, threat hunting, threat intelligence analysis, vulnerability management, and maintenance of SOC documentation and procedures. The role requires compliance with applicable federal cybersecurity frameworks and requirements, including NIST, FISMA, and DHS/CISA directives and guidance.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field from an accredited college or university; relevant work experience may be considered in lieu of a degree.
At least 3 years of experience in cybersecurity operations, security event monitoring, or a related field, including demonstrated experience in a SOC or cyber defense environment.
Demonstrated experience with SIEM platforms and security monitoring tools in an operational environment.
At least one of the following certifications: CompTIA Security+, CompTIA Cybersecurity Analyst (CySA+), Certified SOC Analyst (CSA), GIAC Security Essentials (GSEC), GIAC Certified Incident Handler (GCIH), or Systems Security Certified Practitioner (SSCP).
Strong written and oral English communication skills, including the ability to document and communicate security findings and analysis to technical and non-technical audiences.
Solid understanding of security event monitoring, alert triage, and incident response processes and procedures in a SOC environment.
Working knowledge of SIEM platforms such as Splunk, Microsoft Sentinel, or ArcSight, including log searches, basic queries, and security event analysis.
Foundational knowledge of network security concepts, including TCP/IP, DNS, HTTP/S, firewalls, and IDS/IPS, and ability to analyze basic traffic patterns for potentially malicious activity.
Experience with EDR tools and investigating host-based security alerts and endpoint indicators of compromise.
Familiarity with the MITRE ATT&CK framework and applying its tactics and techniques to analyze and classify events and incidents.
Ability to analyze logs from common sources, including Windows Event Logs, Syslog, and application logs.
Familiarity with threat intelligence concepts and using feeds and indicators of compromise to support monitoring and analysis.
Knowledge of federal cybersecurity frameworks and requirements, including NIST SP 800-53, NIST SP 800-61, and FISMA, and their application to federal SOC operations.
Ability to accurately and thoroughly document security events, incidents, and investigative findings in ticketing and case management systems.
Strong analytical and problem-solving skills, including assessing alerts, identifying patterns of potentially malicious activity, and appropriately escalating findings.
Ability to work independently and collaboratively in a fast-paced SOC environment and manage multiple concurrent tasks and priorities.
Ability to obtain and maintain a Public Trust Clearance.

Nice To Haves

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field.
At least 5 years of cybersecurity operations experience, especially SOC operations in a federal government or defense contracting environment.
Prior experience supporting SBA or another federal civilian agency’s SOC operations or cybersecurity programs.
Experience with cloud security monitoring in AWS, Azure, or GCP, including cloud-native logging and monitoring services such as AWS CloudTrail, Azure Monitor, or Google Cloud Logging.
Familiarity with SOAR platforms and basic Python or PowerShell scripting to automate routine SOC tasks and workflows.
Experience supporting vulnerability management with scanning tools such as Tenable Nessus or Qualys.
Knowledge of Zero Trust Architecture principles and their implications for federal IT security monitoring and SOC operations.
Familiarity with CDM tools, data requirements, and their role in federal civilian agency SOC operations.
Experience participating in incident response and contributing to after-action reviews and lessons learned.
Familiarity with digital forensics concepts and basic techniques for collecting and preserving digital evidence.
GIAC Security Operations Certified (GSOC) or GIAC Certified Enterprise Defender (GCED) certification.
Experience in a FedRAMP-authorized cloud environment and familiarity with FedRAMP requirements relevant to SOC monitoring and incident response.

Responsibilities

Continuously monitor SBA networks, systems, endpoints, and cloud environments using SIEM platforms, IDS/IPS tools, EDR solutions, and other security technologies to identify threats, anomalies, and indicators of compromise.
Analyze and triage security events and alerts, determine their validity, scope, and severity, and escalate confirmed or suspected incidents according to established procedures.
Support incident response, including initial containment, evidence preservation, and coordination with senior analysts and the Technical Lead, following SBA policies and NIST SP 800-61 guidance.
Investigate events and incidents using network traffic, system logs, endpoint telemetry, and other relevant data to determine root cause, scope, and impact.
Document events, incidents, and findings in ticketing and case management systems in accordance with documentation standards.
Assist senior analysts and the Technical Lead with developing and refining SIEM detection rules, correlation logic, and alert thresholds, and provide recommendations based on alert patterns and false-positive analysis.
Execute predefined threat-hunting playbooks and assist senior threat hunters in identifying indicators of compromise and malicious activity.
Monitor and analyze government and commercial threat intelligence, including US-CERT, CISA, and relevant ISAC sources, and incorporate relevant information into SOC monitoring and analysis.
Assist in developing and maintaining SOC SOPs, incident response playbooks, and runbooks, incorporating operational experience and lessons learned.
Collaborate with SBA IT teams, system owners, and stakeholders to communicate security findings, support remediation coordination, and improve security posture.
Support vulnerability management by reviewing scan results, helping identify high-priority vulnerabilities, and coordinating remediation tracking and follow-up with system owners.
Participate in after-action reviews and lessons-learned sessions, contributing observations and recommendations to improve SOC processes and capabilities.
Prepare and contribute to incident reports, shift handover reports, and other SOC documentation.
Participate in SOC training, tabletop exercises, and professional development activities.
Ensure SOC activities comply with applicable federal cybersecurity frameworks, policies, and regulations, including NIST, FISMA, and DHS/CISA directives and guidance.