Security Operations Center (SOC) Analyst
About The Position
Leidos is seeking a proactive Security Operations Center (SOC) Analyst to safeguard sensitive digital mission environments from sophisticated and persistent cyber threats. The analyst will serve on a 24x7 front-line security operations team and is expected to bring strong critical thinking, an adversary-focused mindset, and self-motivation to a high-stakes mission. The role investigates and triages alerts from endpoints, IDS/IPS, NetFlow, and custom sensors; analyzes highly classified logs and correlates data for complex incident investigations; documents technical findings and adversary TTPs for stakeholders; and operationalizes classified threat intelligence and IOCs in security sensors and SIEM platforms. The analyst collaborates with incident response teams and communicates incidents to mission partners. The position follows a predictable five-day, eight-hour shift structure supporting continuous 24x7 coverage. Available coverage windows are day (8:00 AM–4:00 PM), swing (4:00 PM–12:00 AM), and mid (12:00 AM–8:00 AM). Shift preferences are considered where possible, subject to program requirements. The position is located in the Scott AFB, Illinois area; candidates must be within a two-hour commute or able to self-relocate.
Requirements
- Must hold an active DoD Top Secret security clearance.
- Must have a current DoD 8570 IAT Level II or higher certification, such as CompTIA Security+ CE, ISC2 SSCP, SANS GSEC, or an equivalent 8140 qualification.
- Must be able to obtain a DoD 8570 CSSP-Analyst-level certification, such as CEH, CySA+, GCIA, or equivalent, within 180 days of hire.
- Solid foundation in networking principles, including packet analysis, common ports and protocols, traffic flow, the OSI model, and defense-in-depth architecture.
- Bachelor's degree and at least 2 years of relevant experience; equivalent professional work or military experience may be considered in lieu of a degree.
- Must be within commuting distance of Scott AFB, Illinois (within two hours), or able to self-relocate there.
- Ability to work within the operational demands and rigorous standards of a 24x7 Security Operations Center.
- Strong critical thinking, ability to correlate disparate data and analyze raw packet data, and an adversary-focused approach to investigating complex security events.
- Self-motivation and ownership of professional development.
- Adaptability to changing threat conditions, priorities, processes, tools, and analytical methods.
Nice To Haves
- Prior experience in a TS/SCI operational environment, DISA, or another specialized DoD agency.
- Experience applying intelligence-driven defense strategies using the MITRE ATT&CK or Cyber Kill Chain frameworks against known APT intrusion sets.
- In-depth experience using SIEM/SOAR platforms for behavioral and statistical analysis across multiple log types within a classified network.
- Knowledge or experience defending classified cloud environments, such as AWS Secret/Top Secret or Azure Government Secret/Top Secret.
- Basic scripting and programming skills, such as Python or PowerShell.
Responsibilities
- Investigate and triage security alerts from endpoints, IDS/IPS, NetFlow, and custom sensors to identify and neutralize threats.
- Analyze extensive, highly classified log files, pivot across disparate datasets, and correlate evidence for complex incident investigations.
- Produce detailed technical findings and reports for high-level stakeholders, documenting adversary tactics, techniques, and procedures (TTPs).
- Integrate and operationalize highly classified threat intelligence feeds and Indicators of Compromise (IOCs) into security sensors and SIEM platforms.
- Collaborate with specialized incident response teams and communicate security incidents to mission partners in a timely and precise manner.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
