SOC Analyst I

American Systems•Monterey, CA

18h

About The Position

AMERICAN SYSTEMS is seeking a SOC Analyst I to provide Tier I cybersecurity support in a Security Operations Center (SOC). The analyst tracks and reports cyber threats, events, and incidents; performs threat analysis; and investigates security incidents. For incidents, the analyst identifies the source and scope and assesses impact, provides initial response and containment, and escalates incidents when necessary. The role reports to the Incident Handler Principle and works closely with Tier I and Tier II personnel to serve customers. The analyst uses intrusion detection technologies, SOC procedures, checklists, and monitoring tools to review alerts, document and manage incident tickets, identify malware and vulnerabilities, preserve evidence, and support incident response. Under supervision, the analyst may manage or configure security monitoring tools and may assist in designing incident response for cloud service models. This position requires U.S. citizenship and an active Department of War Interim Secret or Secret clearance. The team operates in a 24/7 shift environment; this position's stated schedule is Monday through Thursday, 6:45 a.m. to 5:15 p.m. PST. The stated pay range is USD $38.72 to $40 per hour. AMERICAN SYSTEMS describes itself as an employee-owned federal government contractor supporting national priority programs in Information Technology, Test & Evaluation, Engineering & Analysis, and Training.

Requirements

U.S. citizenship.
Active Department of War Interim Secret or Secret clearance.
At least one DoD 8570.01-M / DoD Directive 8140.01 IAT Level II or higher certification, or ability to obtain one within six months of hire.
At least one of the following certifications, or ability to obtain one within six months of hire: CompTIA CySA+, EC-Council CEH, GIAC GCIA, Microsoft AZ-900, Palo Alto Networks PCCET, or Splunk Core Certified Advanced Power User.
At least one year of professional experience in networking, UNIX/Linux system administration, software engineering, or software development, or a bachelor's degree in computer science, engineering, information technology, cybersecurity, or a related field in place of that experience.
Knowledge of or experience with computer networking concepts, the OSI model, TCP/IP, Dynamic Host Configuration, DNS, directory services, and network security.
Knowledge of host/network access control mechanisms, such as access control lists and capabilities lists.
Knowledge of network traffic analysis methods and packet-level analysis.
Knowledge of cyber threats and vulnerabilities, cyber-attack stages, attack and attacker classes, and cyber defense and information security policies and procedures.
Knowledge of incident response and handling methodologies, incident categories, and response timelines.
Knowledge of intrusion detection methodologies and techniques for detecting host- and network-based intrusions.
Knowledge of malware analysis concepts and methodologies.
Knowledge of system administration, network and operating system hardening techniques, and data backup.
Proficiency in at least one programming language.
Working understanding of computer forensic techniques and methodologies.
Availability to support the stated Monday-through-Thursday schedule in a team operating in a 24/7 shift environment.

Responsibilities

Track and report cybersecurity threats, events, and incidents in a SOC environment.
Perform threat analysis and investigate security incidents, identifying their source and scope and assessing their impact.
Provide initial incident response and containment measures and escalate incidents to higher tiers when necessary.
Work with Tier I and Tier II personnel to provide service to customers.
Use intrusion detection technologies to identify host- and network-based intrusions.
Create, update, resolve, and document Tier I incident tickets; create tickets for alerts requiring Tier 2 review.
Identify, capture, contain, and report malware using protective measures such as network intrusion prevention systems, anti-malware tools, device restrictions, and spam filters.
Recognize and categorize vulnerabilities and associated risks.
Use SOC standard operating procedures to perform daily tasks, resolve incidents, and preserve evidence integrity; provide input to procedure updates as needed.
Perform damage assessments, secure network communications, and use security event correlation.
Review alerts and events from SOC sensors using the SOC checklist to assess relevancy and urgency.
Review open-source and other information to identify events for transition into the incident response process.
Under supervision, manage and configure security monitoring tools, such as SIEM, IDS, firewalls, and access control lists, to mitigate threats and vulnerabilities.
Assist with the design of incident response for cloud service models.