Senior SOC Analyst

ECS Federal•FAIRFAX, VA

1d•Hybrid

About The Position

Everforth ECS is seeking a Senior SOC Analyst to help establish and operate the program’s Security Operations Center for a new unclassified AWS environment. This is a hands-on role serving as the primary SOC resource, responsible for security monitoring, threat hunting, incident analysis and response, and SIEM development. The analyst will independently investigate complex alerts and anomalous activity, determine whether events constitute security incidents, and lead confirmed incidents through the full response lifecycle. The role also focuses on improving detection coverage, incident response processes, documentation, and overall SOC capabilities. The Senior SOC Analyst reports to the Senior Information System Security Manager and works in a hybrid capacity from the Fairfax, Virginia office, with the ability to work onsite up to three days per week. Additional onsite support may be required based on operational or mission needs.

Requirements

U.S. citizenship.
Ability to obtain a Secret clearance; an active clearance is preferred.
Active DoD 8140 IAT Level II certification, such as Security+, or higher.
Ability to work in a hybrid capacity from the Fairfax, VA office up to three days per week; additional onsite support may be required based on operational or mission needs.
At least 8 years of cybersecurity experience, including at least 4 years in a SOC environment.
Strong experience with SIEM technologies, including developing queries, correlation rules, alerts, dashboards, reports, and detection logic.
Demonstrated ability to independently triage and investigate complex security alerts, notable events, anomalous activity, and potential cybersecurity incidents.
Experience owning cybersecurity incidents through detection and analysis, containment, eradication, recovery, and post-incident review.
Direct experience supporting security monitoring and incident response in AWS environments, including analysis of CloudTrail, CloudWatch, VPC Flow Logs, GuardDuty, IAM activity, and other AWS security telemetry.
Strong understanding of Windows, Linux, networking, cloud infrastructure, endpoint security, applications, identity, and authentication as they relate to security monitoring and incident response.
Experience analyzing and correlating telemetry from endpoint, network, identity, cloud, application, and operating system sources.
Experience onboarding and validating log sources to ensure security telemetry is complete, accurate, and usable for monitoring and investigation.
Experience analyzing identity and authentication activity from Microsoft Entra ID, Active Directory, or similar identity platforms.
Experience analyzing indicators of compromise, CVEs, suspicious authentication activity, and adversary tactics, techniques, and procedures.
Experience conducting proactive threat hunts and developing or tuning detections based on observed activity, threat intelligence, and emerging threats.
Experience developing and maintaining SOC procedures, incident response playbooks, runbooks, escalation processes, and operational workflows.
Working knowledge of MITRE ATT&CK or similar frameworks, with experience applying them to investigations, detection development, and threat hunting.
Ability to lead technical incident response, coordinate actions across technical teams, and maintain accurate incident documentation.
Ability to independently manage SOC operations and prioritize alerts, investigations, incidents, and other operational requirements.
Strong problem-solving and decision-making capabilities, including weighing costs and benefits of potential actions and identifying appropriate solutions.
Highly developed interpersonal and oral and written communication skills, including the ability to interact professionally with diverse stakeholders, from peers and end users to executive management.

Nice To Haves

Active Secret clearance.

Responsibilities

Serve as the primary SOC resource for a new unclassified AWS environment.
Build, configure, tune, and continuously improve SIEM queries, correlation rules, alerts, dashboards, reports, and detection content.
Monitor and investigate security alerts, notable events, indicators of compromise, and anomalous activity to determine whether activity is an explained anomaly or a potential cybersecurity incident.
Own confirmed cybersecurity incidents from detection through closure, maintaining accurate and complete incident tickets, timelines, findings, response actions, and supporting evidence.
Analyze endpoint, network, identity, cloud, application, operating system, and other available security telemetry to determine incident scope, impact, attack vector, and root cause.
Coordinate incident response with cybersecurity, cloud, network, system administration, application, and other technical teams, ensuring participating teams document required actions and evidence.
Ensure incident response addresses detection, analysis, containment, eradication, recovery, and post-incident review.
Analyze and correlate indicators of compromise, CVEs, threat intelligence, malicious infrastructure, and adversary tactics, techniques, and procedures to assess potential impact and develop detections, threat hunts, and defensive actions.
Apply frameworks such as MITRE ATT&CK to investigations, detection development, and proactive threat hunting.
Tune detection logic to improve coverage, identify gaps, and reduce false positives.
Develop and maintain SOC standard operating procedures, incident runbooks, escalation procedures, and supporting operational documentation.
Identify opportunities to automate alert enrichment, event correlation, investigation workflows, ticketing, and SOC reporting.
Develop SOC metrics and reporting on alert trends, incident activity, response performance, and identified security gaps.
Lead post-incident After Action Reports, documenting timelines, response activities, lessons learned, root cause, and recommended improvements.
Mentor junior analysts and provide technical guidance during investigations and incident response.
Continuously evaluate and improve SOC monitoring, detection, investigation, and incident response capabilities.
Perform other duties as assigned.