Senior Cyber Defense Analyst

SOSi•Camp HM Smith, HI

About The Position

The Senior Cyber Defense Analyst Lead serves as the senior analyst and shift lead within SOSi’s INDOPACOM Network Security Operations Center, supporting 24/7/365 cyber defense operations across multi-enclave coalition environments. The role leads monitoring, detection validation, threat hunting, incident investigation, and shift-level response, helping protect critical mission capabilities in classified operational environments. It works closely with analysts, engineers, operations teams, Government stakeholders, and mission partners to improve detection and response processes, including AI-assisted workflows and automation.

Requirements

Active in-scope Top Secret/SCI clearance.
DoD 8140 / 8570 IAT Level II certification required within 180 days of hire, such as Security+ CE, CySA+, GSEC, CCNA Security, or equivalent.
At least 5 years of SOC, CSSP, Defensive Cyberspace Operations, or cyber defense experience, including incident response and threat hunting.
Experience as a senior analyst, shift lead, incident lead, or escalation point in a SOC or enterprise cyber defense environment.
Strong understanding of adversary TTPs, MITRE ATT&CK, malware analysis fundamentals, cyber kill chain concepts, and advanced detection and response techniques.
Hands-on experience with SIEM, EDR, SOAR, packet capture and analysis tools, and enterprise monitoring platforms; examples include Splunk, Elastic, Defender, Wireshark, Zeek, and ServiceNow.
Ability to coordinate cross-functional response among analysts, engineers, operations teams, Government stakeholders, and mission partners during incidents and operational events.
Strong written and verbal communication skills, including briefing technical findings, incident status, operational risk, and recommended actions to technical and non-technical audiences.
Flexibility to support 24/7/365 operations, including rotating shifts, nights, weekends, holidays, on-call support, and surge coverage during major incidents or exercises.

Nice To Haves

Advanced certifications such as GCIA, GCIH, GDAT, GCTI, CISSP, CASP+, or equivalent.
Experience supporting DISA, CSSP, TNCC, INDOPACOM, coalition, or military cyber defense environments.
Prior Tier 2/Tier 3 SOC analyst, shift lead, incident commander, battle captain, or major incident coordination experience.
Experience with AI/ML-assisted SOC platforms, automation pipelines, SOAR workflows, and operational analytics platforms.
Experience building, maturing, or refining SOC workflows, CONOPS, SOPs, escalation procedures, dashboards, and reporting products.
Experience with Mavin, Power BI, JIRA, ServiceNow, Elastic, Splunk, Microsoft Defender, Zeek, Wireshark, or similar enterprise platforms.

Responsibilities

Serve as senior analyst and shift lead, directing monitoring priorities, triage, threat hunting, and incident investigations.
Coordinate shift-level response to alerts, incidents, outages, and mission-impacting events, escalating as required.
Validate, adjudicate, and prioritize detections from AI-assisted SOC tools, SIEM, EDR, SOAR, and enterprise monitoring platforms.
Lead initial incident triage and support containment, remediation, evidence preservation, reporting, and shift handoffs.
Mentor junior and mid-level analysts in detection analysis, threat hunting, incident response, documentation, and operational practices.
Coordinate with analysts, DCAI engineers, detection engineering, NetOps, SysOps, and mission partners to refine detections, playbooks, workflows, and response procedures.
Conduct threat hunts based on adversary TTPs, threat intelligence, anomalies, and mission-specific risk indicators.
Ensure accurate documentation of incidents, investigations, shift notes, case updates, and lessons learned in accordance with SOPs and reporting requirements.
Support red/blue team events, tabletop exercises, operational drills, and after-action reviews.
Provide verbal and written shift updates, incident summaries, and operational reports to leadership, Government stakeholders, and mission partners.
Maintain awareness of enterprise cyber, network, system, and mission environments to support detection, correlation, and mission-impact assessment.
Support compliance with RMF, CSSP, DoD 8140, SOPs, and accreditation requirements for AI-augmented cyber defense and incident response.