Senior SOC Analyst

Peraton•,

6d•$104,000 - $166,000•Remote

About The Position

Peraton is seeking a Senior SOC Analyst to join a team supporting the Department of State Bureau of Diplomatic Technology Consular Affairs Enterprise Infrastructure Operations program. The program provides IT operations and maintenance to modernize legacy networks, applications, and databases that support consular applications and services globally. This position is fully remote, with preference for candidates in the Washington, DC, metropolitan area for occasional onsite meetings, training, or customer support in Washington, DC, or Sterling, VA. Onsite requirements may change based on government or program needs, including possible periods of five days per week in the office. The core schedule is Saturday through Wednesday, 7:00 a.m. to 3:30 p.m. EST. The role monitors and investigates security activity, conducts threat hunting and forensic analysis, uses SIEM and EDR tools, develops SOC procedures, reports investigation findings, advises on risk mitigation, and trains junior team members. The stated target salary range is $104,000–$166,000; employees may also be eligible for overtime, shift differential, and a discretionary bonus, depending on the position.

Requirements

Bachelor’s degree and 8 years of experience, or a master’s degree and 6 years, or an associate degree and 10 years, or a high school diploma/equivalent and 12 years.
U.S. citizenship and an active SECRET security clearance.
Security+ CE or another DoD 8570 IAT Level II certification.
At least 5 years of cybersecurity, SOC, or systems security experience in a federal government environment supporting business-critical, high-availability systems.
At least 3 years of experience working with a SIEM platform, preferably Splunk.
Experience using Splunk or similar dashboards and Microsoft Sentinel for security monitoring and analysis.
At least 4 years of experience querying and analyzing security data, including SPL, with a working understanding of data types, conditions, and regular expressions.
Working knowledge of system, network, and application security threats and vulnerabilities, and ability to support development and improvement of monitoring solutions.
Understanding of Boolean logic and event correlation.
Experience identifying logging and monitoring gaps and supporting improvements to security monitoring.
Working knowledge of cybersecurity incidents, anomaly analysis, log analysis, digital forensics, and common threat vectors.
Understanding of TCP/IP, UDP, network ports, protocols, and traffic flow.
Familiarity with cybersecurity frameworks and specifications, including RMF and NIST standards such as NIST SP 800-53.

Nice To Haves

Experience with Splunk data normalization, including field aliases, calculated fields, and field extractions.
Splunk Power User certification or higher.
Experience tracking incidents using the MITRE ATT&CK framework.
Knowledge of cloud security.
Experience with system administration, networking, and operating system hardening techniques.
Experience with Linux and Windows.
Experience troubleshooting storage-related issues.
Scripting or coding experience.
Knowledge of Web Application Firewall (WAF) security features.

Responsibilities

Monitor and investigate security alerts, conduct threat hunting, and notify designated managers, cyber incident responders, and cybersecurity service provider personnel of suspected incidents.
Communicate event history, status, and potential impact in accordance with the organization’s cyber incident response plan.
Analyze and characterize network traffic to identify anomalous activity and potential threats to network resources.
Create advanced ad hoc SPL queries.
Coordinate with internal and external teams to investigate threats, assess risks, and conduct forensic analysis.
Review and analyze host, network traffic, firewall, and IDS logs to identify potential security threats.
Use SIEM and EDR tools to monitor the operational environment.
Develop and document configuration standards, policies, and procedures for operating, managing, and securing system infrastructure.
Advise management and team members on technology risks and recommend mitigation strategies.
Provide technical expertise and thought leadership to multiple levels of management.
Prepare reports detailing investigations, incidents, and other security-related activities.
Identify and classify attack tactics and techniques.
Recommend and implement enhancements to improve system performance, security, and reliability.
Build and refine SOC processes and procedures, including documenting work in SOPs.
Train and mentor junior SOC team members.
Plan and execute SOC-related projects and initiatives.
Communicate clearly and professionally with managers and colleagues.
Demonstrate flexibility and take on additional responsibilities as needed.