Security Operations Center Analyst - Mid

Koniag Government Services, LLC•Washington, DC

2d•$130,000 - $155,000•Onsite

About The Position

Koniag Operations Services, LLC (KOS), a Koniag Government Services company, is seeking a Mid-Level Security Operations Center (SOC) Analyst to support the U.S. Small Business Administration (SBA) in Washington, DC. The position requires the ability to obtain and maintain a Public Trust clearance. The analyst will monitor SBA’s enterprise IT environment, detect and investigate threats, analyze security events, and support incident response in accordance with federal cybersecurity policies and SBA security requirements. Working under the guidance of the Cybersecurity Operations Technical Lead and Senior Cyber Defense Analysts, the analyst will contribute to SOC operations while continuing to develop technical skills. The role includes monitoring systems and networks, triaging alerts, investigating incidents, documenting findings, supporting threat hunting and vulnerability management, and collaborating with SBA teams and stakeholders. SOC activities must comply with applicable federal cybersecurity frameworks, policies, and regulations, including NIST, FISMA, and DHS/CISA guidance.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field from an accredited college or university; relevant work experience may be considered in lieu of a degree.
At least 3 years of experience in cybersecurity operations, security event monitoring, or a related field, with demonstrated experience in a SOC or cyber defense environment.
Demonstrated experience using SIEM platforms and security monitoring tools in an operational environment.
At least one of the following certifications: CompTIA Security+, CompTIA CySA+, Certified SOC Analyst (CSA), GIAC Security Essentials (GSEC), GIAC Certified Incident Handler (GCIH), or Systems Security Certified Practitioner (SSCP).
Strong written and oral English communication skills, including the ability to communicate and document findings for technical and non-technical audiences.
Solid understanding of security event monitoring, alert triage, and incident response processes in a SOC environment.
Working knowledge of SIEM platforms such as Splunk, Microsoft Sentinel, or ArcSight, including log searches, basic queries, and security event analysis.
Foundational knowledge of network security concepts, including TCP/IP, DNS, HTTP/S, firewalls, IDS/IPS, and basic network traffic analysis.
Experience with EDR tools and investigating host-based security alerts and endpoint indicators of compromise.
Familiarity with the MITRE ATT&CK framework and applying its tactics and techniques to analyze and classify security events and incidents.
Ability to analyze Windows Event Logs, Syslog, and application logs to support investigations and incident response.
Familiarity with threat intelligence concepts and using feeds and indicators of compromise for security monitoring and analysis.
Knowledge of federal cybersecurity requirements and frameworks, including NIST SP 800-53, NIST SP 800-61, and FISMA, and their application in federal SOC operations.
Ability to document security events, incidents, and investigative findings clearly, concisely, and thoroughly in ticketing and case management systems.
Strong analytical and problem-solving skills, including the ability to identify patterns of potentially malicious activity and escalate findings appropriately.
Ability to work independently and collaboratively in a fast-paced, mission-driven SOC environment and manage concurrent tasks and priorities.
Ability to obtain and maintain a Public Trust clearance.

Nice To Haves

At least 5 years of cybersecurity operations experience focused on SOC operations in a federal government or defense contracting environment.
Prior experience supporting SBA or another federal civilian agency’s SOC operations or cybersecurity programs.
Experience with cloud security monitoring in AWS, Azure, or GCP, including cloud-native logging and monitoring services such as AWS CloudTrail, Azure Monitor, or Google Cloud Logging.
Familiarity with SOAR platforms and basic Python or PowerShell scripting to automate routine SOC tasks and workflows.
Experience supporting vulnerability management with tools such as Tenable Nessus, Qualys, or similar platforms.
Knowledge of Zero Trust Architecture principles and their implications for federal SOC operations.
Familiarity with CDM program tools, data requirements, and their role in federal civilian agency SOC operations.
Experience participating in incident response and contributing to after-action reviews and lessons-learned processes.
Familiarity with digital forensics concepts and basic forensic investigation techniques for collecting and preserving digital evidence.
GIAC Security Operations Certified (GSOC) or GIAC Certified Enterprise Defender (GCED) certification.
Experience in a FedRAMP-authorized cloud environment and familiarity with related security requirements for SOC monitoring and incident response.

Responsibilities

Continuously monitor SBA networks, systems, endpoints, and cloud environments using SIEM platforms, IDS/IPS tools, EDR solutions, and other security technologies.
Analyze and triage security events and alerts; assess their validity, scope, and severity, and escalate suspected or confirmed incidents according to established procedures.
Support incident response, including initial containment, evidence preservation, and coordination with senior analysts and the Technical Lead, following SBA policies and NIST SP 800-61 guidelines.
Investigate events and incidents using network traffic, system logs, endpoint telemetry, and other data to identify root cause, scope, and impact.
Document security events, incidents, and investigative findings in ticketing and case management systems, maintaining records in accordance with documentation standards.
Assist in developing and refining SIEM detection rules, correlation logic, and alerting thresholds; recommend improvements based on alert patterns and false-positive analysis.
Support threat hunting by executing predefined playbooks and assisting senior threat hunters in identifying indicators of compromise and malicious activity.
Monitor threat intelligence from government and commercial sources, including US-CERT, CISA, and relevant ISACs, and incorporate relevant intelligence into SOC monitoring and analysis.
Assist in developing and maintaining SOC SOPs, incident response playbooks, and runbooks, including updates based on operational experience and lessons learned.
Collaborate with SBA IT teams, system owners, and other stakeholders to communicate findings, support remediation coordination, and improve security posture.
Support vulnerability management by reviewing scan results, identifying high-priority vulnerabilities, and coordinating remediation tracking and follow-up with system owners.
Participate in after-action reviews and lessons-learned sessions, contributing observations and recommendations to improve SOC processes and capabilities.
Prepare or contribute to incident reports, shift handover reports, and other SOC documentation, ensuring accuracy, completeness, and adherence to reporting standards.
Participate in SOC training, tabletop exercises, and professional development activities.
Ensure SOC activities comply with applicable federal cybersecurity frameworks, policies, and regulations, including NIST, FISMA, and DHS/CISA directives and guidance.