SOC Analyst I

AMERICAN SYSTEMS•Monterey, CA

2d•$39 - $40

About The Position

AMERICAN SYSTEMS is an employee-owned federal government contractor supporting national priority programs in Information Technology, Test & Evaluation, Engineering & Analysis, and Training. The SOC Analyst I provides Tier I cybersecurity support in a Security Operations Center by tracking and reporting cyber threats, events, and incidents. The analyst performs threat analysis and incident investigations, identifies incident sources and scope, assesses impact, provides initial response and containment, and escalates incidents to higher tiers as needed. The role reports to the Incident Handler Principle and works with Tier I and Tier II personnel to provide service to customers. The position operates in a 24/7 shift environment, with this analyst scheduled Monday through Thursday, 6:45 a.m. to 5:15 p.m. PST. Candidates must be U.S. citizens and hold an active Department of War Interim Secret or Secret clearance. The salary range is USD $38.72–$40 per hour, with actual compensation determined by factors permitted by law. AMERICAN SYSTEMS offers healthcare benefits, paid leave, retirement plans, insurance programs, and education and training assistance.

Requirements

Must be a U.S. citizen.
Must hold an active Department of War Interim Secret or Secret clearance.
Must hold at least one certification required by DoD 8570.01-M and DoD Directive 8140.01 at IAT Level II or higher, or be able to obtain one within six months of hire.
Must hold at least one of these certifications or be able to obtain one within six months of hire: CompTIA CySA+, EC-Council CEH, GIAC GCIA, Microsoft AZ 900, Palo Alto Networks PCCET, or Splunk Core Certified Advanced Power User.
At least one year of professional experience in networking, UNIX/Linux system administration, software engineering, or software development; a bachelor's degree in computer science, engineering, information technology, cybersecurity, or a related field may substitute for the experience.
Knowledge of or experience with computer networking concepts, the OSI model, TCP/IP, Dynamic Host Configuration, DNS, directory services, and network security.
Knowledge of host/network access control mechanisms, such as access control lists and capabilities lists.
Knowledge of network traffic analysis methods and packet-level analysis.
Knowledge of cyber threats and vulnerabilities, attack stages and classes, attackers, and cyber defense and information security policies and procedures.
Knowledge of incident response and handling methodologies, incident categories, and timelines.
Knowledge of intrusion detection methodologies and techniques for detecting host- and network-based intrusions.
Knowledge of malware analysis concepts and methodologies.
Knowledge of system administration, network, and operating system hardening techniques, as well as data backup.
Proficiency in at least one programming language.
Working understanding of computer forensic techniques and methodologies.

Responsibilities

Track and report cybersecurity threats, events, and incidents in a SOC environment.
Perform threat analysis and investigate security incidents; identify their source and scope and assess their impact.
Provide initial incident response and containment, escalating incidents to higher tiers when necessary.
Use intrusion detection technologies to identify host- and network-based intrusions.
Create, update, and resolve Tier I incident tickets and document alerts and incidents appropriately.
Create incident tickets for alerts that indicate incidents requiring Tier 2 review.
Identify, capture, contain, and report malware to protect networks, using measures such as NIPS, anti-malware, restrictions on external devices, and spam filters.
Recognize and categorize vulnerabilities and associated information.
Follow SOC standard operating procedures to perform daily tasks, resolve incidents, and preserve evidence integrity; provide input and help update procedures as needed.
Perform damage assessments, secure network communications, and use security event correlation.
Use the SOC checklist to review alerts and events from SOC sensors and determine relevance and urgency.
Review open-source and other information sources to identify events for transition into the incident response process.
Under supervision, manage and configure security monitoring tools, such as SIEM, IDS, firewalls, and access control lists, to mitigate threats and vulnerabilities.
May assist with designing incident response for cloud service models.