Security Ops Analyst

Altus Consulting Corp•Reston, VA

21h

About The Position

Altus Consulting is seeking mid-level SecOps Analysts to support continuous security monitoring, incident triage, investigation, and response within a 24/7/365 cleared cloud Security Operations Center. Analysts monitor security telemetry, investigate alerts, enrich events with context, document findings, and maintain ownership of incidents through escalation and closure. The role is suited to disciplined security professionals who value high-quality analysis, documentation, and teamwork. Candidates with backgrounds in SOC operations, cyber defense, military cyber operations, incident response, or cleared IT operations are encouraged to apply. The position is based in Northern Virginia, in Tysons Corner or Reston, and requires an active TS/SCI clearance with a full-scope polygraph, U.S. citizenship, at least three years of relevant experience, and an applicable Cyber Defense Analyst role-qualifying certification before performing billable work. The role supports assigned coverage in a 24/7 operational environment, which may include day, swing, night, weekend, or holiday shifts.

Requirements

Active TS/SCI clearance with Full Scope Polygraph.
U.S. citizenship.
Three or more years of experience in Security Operations, Cyber Security, Systems Administration, or a comparable technical operations environment.
Hands-on experience with SIEM, IDS, EDR, and case-management or ticketing technologies.
Experience supporting Windows and Linux environments, network infrastructure, and security applications.
Working knowledge of network analysis, vulnerability scanning, and security hardening practices.
Strong analytical, documentation, written, and verbal communication skills.
Ability to support a 24/7 operational environment, including assigned day, swing, night, weekend, or holiday coverage.
Ability to satisfy customer-specific onboarding, access, training, and qualification requirements.
Applicable Cyber Defense Analyst role-qualifying certification required before performing billable work; listed certifications include CompTIA CySA+, GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), Certified Ethical Hacker (CEH), and CISSP.

Nice To Haves

Experience working in a Security Operations Center, Cyber Defense Team, Cyber Incident Response Team, military cyber organization, or similar operational environment.
Hands-on experience with Splunk, Elastic/ELK, Google SecOps/Chronicle, or comparable SIEM technologies.
Experience with EDR, IDS/IPS, network monitoring, and security case-management platforms.
Experience with ServiceNow or comparable ticketing and case-management tools.
Familiarity with Google Cloud security capabilities, including Security Command Center, Cloud Audit Logs, IAM, and GKE.
Knowledge of MITRE ATT&CK, threat hunting, detection engineering, and incident response practices.
Familiarity with Kubernetes or air-gapped computing environments.
Python or PowerShell scripting experience.
Previous experience supporting classified, SCIF, Intelligence Community, Department of Defense, or Federal cybersecurity environments.

Responsibilities

Continuously monitor security alerts and events using SIEM, EDR, IDS, and other cybersecurity platforms.
Perform initial alert triage, enrichment, event correlation, and investigation.
Categorize and prioritize security incidents based on severity, impact, and established procedures.
Maintain ownership of assigned alerts throughout investigation, escalation, documentation, and closure.
Develop diagnostic summaries documenting observed activity, analysis performed, indicators of compromise, and recommended disposition.
Create and maintain security cases using ServiceNow or other designated case-management platforms.
Escalate incidents in accordance with established SecOps procedures and runbooks.
Perform structured handoffs for active High and Critical incidents between shifts.
Support incident documentation, security reporting, situational awareness, and operational metrics.
Identify opportunities to improve security detections, playbooks, and response processes.
Collaborate with SecOps Managers, security engineers, incident responders, and other technical teams to resolve security events.