Security Operations Center (SOC) Analyst II

Leidos • Shiloh, IL

1d • $87,100 - $157,450 • Onsite

About The Position

Leidos is hiring a Security Operations Center Analyst to defend sensitive mission environments from sophisticated and persistent cyber threats. The role is part of a 24x7 front-line security operations team and involves investigating security alerts, analyzing classified log data, documenting technical findings, operationalizing threat intelligence, and coordinating with incident response teams and mission partners.

The position requires strong critical thinking, an adversary-focused approach, self-motivation, and the ability to adapt to changing threats, priorities, tools, and processes. Work follows a predictable five-day, eight-hour shift structure, with day, swing, and midnight coverage options. Shift preferences are considered where possible, subject to mission requirements.

The position is based within commuting distance of Scott AFB, Illinois, or requires the ability to self-relocate there. An active DoD Top Secret clearance and current DoD 8570 IAT Level II certification or higher are required. The selected candidate must be able to obtain a DoD 8570 CSSP-Analyst-level certification within 180 days of hire. A bachelor's degree and four or more years of relevant experience are required, although equivalent professional work or military experience may substitute for the degree.

Requirements

• Active DoD Top Secret security clearance.
• Current DoD 8570 IAT Level II or higher certification, such as CompTIA Security+ CE, ISC2 SSCP, SANS GSEC, or an equivalent 8140 qualification.
• Ability to obtain a DoD 8570 CSSP-Analyst-level certification, such as CEH, CySA+, or GCIA, or an equivalent certification, within 180 days of hire.
• Solid foundation in networking principles, including packet analysis, common ports and protocols, traffic flow, the OSI model, and defense-in-depth architecture.
• Bachelor's degree and at least four years of relevant experience; equivalent professional work or military experience may be considered in lieu of a degree.
• Ability to commute to Scott AFB, Illinois, within two hours, or self-relocate there.
• Ability to work in a 24x7 security operations environment and adapt to changing threat landscapes, priorities, processes, tools, and analytical methods.
• Self-motivation and ownership of professional development.

Nice To Haves

• Prior experience in a TS/SCI operational environment, DISA, or another specialized DoD agency.
• Experience with intelligence-driven defense using MITRE ATT&CK or Cyber Kill Chain frameworks against known APT intrusion sets.
• In-depth experience using SIEM/SOAR platforms for behavioral and statistical analysis across multiple log types in a classified network.
• Knowledge or experience defending classified cloud environments, such as AWS Secret/Top Secret or Azure Government Secret/Top Secret.
• Basic scripting and programming skills, such as Python or PowerShell.

Responsibilities

• Investigate and triage security alerts from endpoints, IDS/IPS, NetFlow, and custom sensors to identify and neutralize threats in mission environments.
• Analyze extensive, highly classified log files by pivoting between datasets and correlating evidence for complex incident investigations.
• Produce detailed technical findings and reports for high-level stakeholders, documenting adversary tactics, techniques, and procedures.
• Integrate and operationalize classified threat intelligence feeds and Indicators of Compromise into security sensors and SIEM platforms.
• Collaborate with specialized incident response teams and communicate security incidents promptly and precisely to mission partners.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level