Security Operations Center (SOC) Analyst

JCS Solutions LLC•Alexandria, VA

6d•$75,000 - $130,000•Hybrid

About The Position

JCS Solutions is seeking an experienced technical individual contributor to support the Pentagon Reservation under the DISA Penetration Handling, Incident, System Health (PHISH) Support Services II program. The analyst supports a 24/7 Security Operations Center mission through continuous monitoring, detection, analysis, escalation, mitigation, and response to cybersecurity events affecting customer networks, endpoints, servers, applications, cloud environments, and mission systems. The role uses security telemetry, threat intelligence, analytic procedures, and operational tools to investigate suspicious activity, document findings, and coordinate response actions with senior analysts, incident responders, cyber engineers, system owners, and mission partners. The position requires availability for rotating shifts, including weekends, holidays, and inclement-weather operations. It requires 60 percent onsite work at the Mark Center in Alexandria, Virginia, consistent with program and customer requirements. The analyst works independently on day-to-day operational objectives and may own defined SOC projects or technical processes. The role also contributes to infrastructure and mission-support activities and may provide technical guidance, coaching, or review to less-experienced personnel. The position requires an active TS/SCI clearance and an active DoD 8140/8570 IAT Level II certification. Candidates must have a bachelor's degree in a related technical discipline and 4–8 years of relevant experience, or an equivalent combination of relevant military service, cybersecurity education, certifications, and professional experience. The general salary range is $75,000–$130,000, with compensation based on factors including location, qualifications, and applicable contract terms.

Requirements

Experience supporting a SOC, CND organization, cyber protection team, incident-response team, network operations center, or comparable cybersecurity operations environment.
Experience monitoring and investigating cybersecurity events using SIEM, EDR, IDS/IPS, endpoint, network, identity, cloud, vulnerability, and log-data sources.
Working knowledge of incident-response processes, including alert triage, investigation, escalation, evidence collection, containment support, remediation coordination, and incident documentation.
Working knowledge of TCP/IP, common ports and protocols, network traffic flow, endpoint and operating-system fundamentals, authentication and identity activity, and enterprise security controls.
Familiarity with adversary tactics, techniques, and procedures; attack vectors; indicators of compromise; common malware behaviors; and analytic frameworks such as MITRE ATT&CK and the Cyber Kill Chain.
Ability to analyze available data, identify gaps or uncertainties, follow established procedures, and communicate technically sound findings and recommendations.
Ability to prepare clear case notes, incident summaries, shift-turnover products, and technical reports for technical and operational audiences.
Ability to collaborate across SOC operations, incident response, cyber engineering, system administration, and customer or mission-partner organizations.
Ability to work independently on assigned operational objectives, technical processes, or projects, while recognizing when to seek assistance or escalate risk.
Active TS/SCI clearance.
Active DoD 8140 IAT Level II certification, such as Security+ CE, CySA+, CASP+ CE, CCNA-Security, CCNP Security, CCSP, CISA, CISSP (or Associate), CND, GCED, GCIH, GICSP, GSEC, or SSCP.
Bachelor’s degree in cybersecurity, information technology, computer science, intelligence studies, or a related technical discipline and 4–8 years of relevant experience; or an equivalent combination of relevant military service, cybersecurity education, certifications, and professional experience.
Availability for rotating shifts, including weekends, holidays, and inclement-weather operations.
Ability to work 60 percent onsite at the Mark Center in Alexandria, Virginia.

Nice To Haves

Experience using enterprise SIEM platforms such as Splunk, Microsoft Sentinel, IBM QRadar, ArcSight, Elastic, or comparable tools.
Experience with EDR, antivirus, host-based security tools, IDS/IPS, network detection and response, vulnerability-management tools, NetFlow, or packet-capture analysis.
Familiarity with Windows and Unix/Linux operating systems, command-line tools, and system-administration concepts.
Experience with structured threat hunting, detection tuning, use-case development, or translating threat intelligence into analytic queries.
Familiarity with malicious-file triage, malware-analysis concepts, network-forensics techniques, or host-forensics artifacts.
Experience with scripting or automation using Python, PowerShell, Bash, or a similar language.
Relevant cybersecurity certifications, including those required by the applicable contract, customer, or Department of War policy.

Responsibilities

Monitor, triage, and investigate alerts from SIEM platforms, EDR tools, IDS/IPS, authentication logs, NetFlow, packet capture, cloud-security tools, vulnerability data, and other security sensors.
Analyze endpoint, host, network, identity, application, and cloud telemetry to identify anomalous, suspicious, or malicious activity.
Investigate incidents by reviewing logs and alerts, correlating evidence, identifying affected systems or accounts, assessing scope and impact, and escalating cases under established procedures.
Apply cyber threat intelligence and knowledge of adversary tactics, techniques, and procedures to validate alerts, identify indicators of compromise, prioritize investigations, and provide context to stakeholders.
Support approved containment, eradication, recovery, and post-incident activities by collecting evidence, documenting actions, validating controls, and coordinating with designated response personnel.
Perform computer forensic network and host analysis for incident investigations, threat hunting, and evidence-based reporting.
Support proactive threat hunts, environment sweeps, and detection validation based on adversary activity, vulnerabilities, and organizational priorities.
Identify false positives, control gaps, telemetry limitations, suspicious trends, vulnerabilities, and adversary behaviors; recommend improvements to detection logic, dashboards, workflows, playbooks, and SOC processes.
Contribute to developing, testing, tuning, and documenting detection use cases, correlation logic, analytic playbooks, standard operating procedures, work instructions, and knowledge-management artifacts.
Document analytic methods, evidence, findings, actions, escalation decisions, and recommended next steps in case-management and knowledge-management systems.
Prepare incident tickets, shift summaries, situational-awareness updates, and technical reports for SOC personnel, incident responders, system owners, and operational stakeholders.
Conduct authorized infrastructure-support activities, including device discovery, operating-system fingerprinting, service scanning, passive network scanning, and support for cybersecurity hardware and software configuration, testing, deployment, and maintenance.
Maintain proficiency with operational tools, cyber-defense methodologies, network and host analysis techniques, and evolving threats.
Support training, exercises, operational planning, and integrated cyber operations as assigned.
Collaborate with SOC operations, incident response, cyber engineering, threat intelligence, system administrators, and mission partners to share findings and support timely remediation.
Provide technical guidance, peer review, and knowledge sharing to junior analysts or other team members, as assigned.