SOC Analyst II

American Systems•Monterey, CA

About The Position

AMERICAN SYSTEMS is seeking a SOC Analyst II to provide Tier II cybersecurity support in a Security Operations Center (SOC). The role involves vulnerability assessments, cyber threat analysis, email gateway monitoring, and reporting confirmed or suspicious activity. The analyst works with Tier I and Tier II personnel to deliver customer support and may help train SOC Analyst I team members. The analyst leads incidents from alert through resolution, using threat intelligence to identify affected systems and attack scope, collecting relevant asset data, directing remediation and recovery, and requesting engineering, forensics, or threat intelligence support as appropriate. The role also includes incident documentation and ticket management, security monitoring tool configuration, threat intelligence notifications, damage assessments, evidence preservation, malware handling, and incident response for cloud service models. The position operates in a 24/7 shift environment. Shifts are 10 hours per day, Monday–Thursday or Friday–Monday, and rotate every three months.

Requirements

Must be a U.S. citizen in accordance with 8 U.S.C. 1324b(a)(2)(C).
Must hold an active Department of War Top Secret clearance.
At least three years of professional experience in incident detection and response, malware analysis, or cyber forensics.
Bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field.
At least one certification required by DoD 8570.01-M and DoD Directive 8140.01 at IAT Level II or higher.
Must hold at least one additional certification from this list: CompTIA CASP+, GIAC GCIH, Microsoft AZ-500, Microsoft SC-200, or Splunk Core Certified Advanced Power User.
Extensive experience with security methodologies, standard operating procedures, processes, and workflows.
Experience configuring and implementing technical security solutions and analyzing and trending security log data from many heterogeneous security devices.
Experience with computer networking concepts, the OSI model, TCP/IP, Dynamic Host Configuration, DNS, directory services, and network security.
Knowledge of host/network access control mechanisms, network security architecture, network traffic analysis, and packet-level analysis.
Knowledge of cyber threats and vulnerabilities, cyber-attack stages, attack and attacker classes, cyber defense, information security policies and procedures, and incident response and handling methodologies.
Knowledge of intrusion detection methodologies and techniques for detecting host- and network-based intrusions.
Knowledge of malware analysis concepts and cloud service models and how those models can limit incident response.
Knowledge of application security risks, including the OWASP Top 10.
Knowledge of system administration, network and operating system hardening, and data backup.
Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and SQL injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
Experience with JIRA, Palo Alto Firewall, SNORT IDS, AlienVault SIEM, Barracuda Mail Spam/Virus Firewall, and HBSS.
Availability to work in a 24/7 shift environment; shifts are 10 hours per day on Monday–Thursday or Friday–Monday and rotate every three months.

Responsibilities

Conduct vulnerability assessments, analyze cyber threats, monitor the email gateway, and report confirmed or suspicious activities.
Work with Tier I and Tier II personnel to provide customer service and assist with training SOC Analyst I team members when needed.
Use intrusion detection technologies to identify host- and network-based intrusions.
Create, update, resolve, and document Tier II incident tickets, alerts, and incidents in the ticketing system.
Review asset discovery and vulnerability assessment data and Tier I trouble tickets.
Lead incidents from alert to resolution by using emerging threat intelligence to identify affected systems and attack scope.
Review and collect asset data, including logs, configurations, and running processes, for investigation.
Determine and direct remediation and recovery efforts, including tasking IHT1 as needed.
Determine and request engineering, forensics, or threat intelligence support.
Inform and brief the CSOC manager, CISO, DCIO, or CIO on incident status.
Manage and configure security monitoring tools such as SIEM, IDS, firewalls, and access control lists to mitigate threats or vulnerabilities as needed.
Review threat intelligence and create and share notifications with designated personnel.
Design incident response for cloud service models and perform damage assessments.
Preserve evidence integrity according to standard operating procedures or national standards.
Protect networks using measures such as NIPS, anti-malware, restrictions on external devices, and spam filters.
Recognize and categorize vulnerabilities and associated attacks, secure network communications, and use security event correlation tools.
Identify, capture, contain, and report malware.
Use SOC standard operating procedures to perform daily tasks, resolve incidents, and preserve evidence; provide input on and assist with procedure updates as needed.
Handle other tasks appropriate to Tier II experience and capability.