Senior SOC Analyst

ECS Tech Inc•Fairfax, VA

17h•$130,000 - $150,000•Hybrid

About The Position

Everforth ECS is seeking a Senior SOC Analyst to work in a hybrid capacity at its Fairfax, Virginia office. The analyst will help stand up and operate the program’s Security Operations Center (SOC), including security monitoring, threat hunting, incident analysis and response, and SIEM development. The role will help build SOC capabilities from the ground up and serve as the primary hands-on SOC resource for a new unclassified AWS environment. The analyst will independently investigate complex alerts and anomalous activity, determine whether events represent security incidents, and manage confirmed incidents through the full response lifecycle. The role also improves detection coverage, response processes, documentation, and overall SOC capabilities. It reports to the Senior Information System Security Manager. The position requires U.S. citizenship, the ability to obtain a Secret clearance (active clearance preferred), and an active DoD 8140 IAT Level II Security+ certification or higher. The analyst must be able to work up to three days per week in a hybrid capacity from Fairfax, Virginia; additional onsite support may be required based on operational or mission needs. Salary is $130,000–$150,000. General benefits information is linked by the employer, but specific benefits are not detailed in the posting.

Requirements

U.S. citizen.
Ability to obtain a Secret clearance; active clearance preferred.
Active DoD 8140 IAT Level II Security+ certification or higher.
Ability to work up to three days per week in a hybrid capacity from Fairfax, Virginia; additional onsite support may be required based on operational or mission needs.
At least 8 years of cybersecurity experience, including at least 4 years in a SOC environment.
Strong experience with SIEM technologies, including developing queries, correlation rules, alerts, dashboards, reports, and detection logic.
Ability to independently triage and investigate complex security alerts, notable events, anomalous activity, and potential cybersecurity incidents.
Experience owning cybersecurity incidents through the full response lifecycle, including detection and analysis, containment, eradication, recovery, and post-incident review.
Direct experience supporting security monitoring and incident response in AWS environments, including analysis of CloudTrail, CloudWatch, VPC Flow Logs, GuardDuty, IAM activity, and other AWS security telemetry.
Strong understanding of Windows, Linux, networking, cloud infrastructure, endpoint security, applications, identity, and authentication as they relate to security monitoring and incident response.
Experience analyzing and correlating endpoint, network, identity, cloud, application, and operating system telemetry from multiple sources.
Experience onboarding and validating log sources to ensure security telemetry is complete, accurate, and usable for monitoring and investigation.
Experience analyzing identity and authentication activity from Microsoft Entra ID, Active Directory, or similar identity platforms.
Experience analyzing IoCs, CVEs, suspicious authentication activity, and TTPs.
Experience conducting proactive threat hunts and developing or tuning detections based on observed activity, threat intelligence, and emerging threats.
Experience developing and maintaining SOC procedures, incident response playbooks, runbooks, escalation processes, and operational workflows.
Working knowledge of MITRE ATT&CK or similar frameworks and experience applying them to investigations, detection development, and threat hunting.
Ability to lead technical incident response, coordinate actions across multiple technical teams, and ensure incident documentation is accurate and complete.
Ability to independently manage SOC operations and prioritize alerts, investigations, incidents, and other operational requirements.
Strong problem-solving and decision-making capabilities, including the ability to weigh the costs and benefits of potential actions and identify an appropriate solution.
Highly developed interpersonal and oral and written communication skills, including the ability to interact professionally with stakeholders ranging from peers and end users to executive management.

Nice To Haves

Active Secret clearance.

Responsibilities

Serve as the primary SOC resource for a new unclassified AWS environment.
Build, configure, tune, and continuously improve SIEM queries, correlation rules, alerts, dashboards, reports, and detection content.
Monitor and investigate security alerts, notable events, indicators of compromise, and anomalous activity to determine whether activity is explained or may be a cybersecurity incident.
Own confirmed cybersecurity incidents from detection through closure, maintaining accurate and complete incident tickets, timelines, findings, response actions, and supporting evidence.
Analyze endpoint, network, identity, cloud, application, operating system, and other security telemetry to determine incident scope, impact, attack vector, and root cause.
Coordinate incident response with cybersecurity, cloud, network, system administration, application, and other technical teams, ensuring participating teams document required actions and evidence.
Address detection, analysis, containment, eradication, recovery, and post-incident review throughout incident response activities.
Analyze and correlate IoCs, CVEs, threat intelligence, malicious infrastructure, and adversary TTPs to assess potential impact and develop detections, threat hunts, and defensive actions.
Apply frameworks such as MITRE ATT&CK to investigations, detection development, and proactive threat hunting.
Tune detection logic to improve coverage, identify gaps, and reduce false positives.
Develop and maintain SOC SOPs, incident runbooks, escalation procedures, and other operational documentation.
Identify opportunities to automate alert enrichment, event correlation, investigation workflows, ticketing, and SOC reporting.
Develop SOC metrics and reports on alert trends, incident activity, response performance, and identified security gaps.
Lead post-incident After Action Reports, documenting timelines, response activities, lessons learned, root causes, and recommended improvements to detections, controls, and response procedures.
Mentor junior analysts and provide technical guidance during investigations and incident response.
Continuously evaluate and improve SOC monitoring, detection, investigation, and incident response capabilities.
Perform other duties as assigned.