SOC Analyst II

AMERICAN SYSTEMS•Monterey, CA

11d•$39 - $44

About The Position

AMERICAN SYSTEMS is an employee-owned federal government contractor supporting national priority programs in Information Technology, Test & Evaluation, Engineering & Analysis, and Training. The SOC Analyst II provides Tier II cybersecurity support in a Security Operations Center (SOC). The role includes conducting vulnerability assessments, analyzing cyber threats, monitoring the email gateway, and reporting confirmed or suspicious activity. The analyst works with Tier I and Tier II personnel to support customers and may assist with training SOC Analyst I team members. The analyst leads incidents from alert through resolution, assesses the scope and impact of attacks, reviews relevant asset data, directs remediation and recovery efforts, and briefs incident status to designated leadership. The position may also involve configuring security monitoring tools, designing incident response for cloud service models, conducting damage assessments, preserving evidence, and protecting networks. The team works in a 24/7 shift environment. Shifts run Monday–Thursday or Friday–Monday, 10 hours per day, and rotate every three months.

Requirements

Must be a U.S. citizen in accordance with 8 U.S.C. 1324b(a)(2)(C).
Must hold an active Department of War Top Secret clearance.
At least three years of professional experience in incident detection and response, malware analysis, or cyber forensics.
Bachelor’s degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field.
At least one certification required by DoD 8570.01-M and DoD Directive 8140.01 at IAT Level II or higher.
At least one additional certification: CompTIA CASP+, GIAC GCIH, Microsoft AZ-500, Microsoft SC-200, or Splunk Core Certified Advanced Power User.
Extensive experience with security methodologies, standard operating procedures, processes, and workflows.
Experience configuring and implementing technical security solutions and analyzing and trending security log data from numerous heterogeneous security devices.
Experience with computer networking concepts, the OSI model, TCP/IP, Dynamic Host Configuration, DNS, directory services, and network security.
Experience with host and network access control mechanisms, such as access control lists and capabilities lists.
Knowledge of network security architecture concepts, including topology, protocols, components, and defense-in-depth principles.
Experience with network traffic analysis methods and packet-level analysis.
Knowledge of cyber threats and vulnerabilities, attack stages and classes, attackers, and cyber defense and information security policies and procedures.
Knowledge of incident response and handling methodologies, incident categories, and timelines.
Knowledge of intrusion detection methodologies and techniques for detecting host- and network-based intrusions.
Knowledge of malware analysis concepts and cloud service models and their effect on incident response.
Knowledge of application security risks, such as the OWASP Top 10.
Knowledge of system administration, network and operating system hardening techniques, and data backup.
Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, PL/SQL and other injections, race conditions, covert channels, replay, return-oriented attacks, and malicious code.
Experience with JIRA, Palo Alto Firewall, SNORT IDS, AlienVault SIEM, Barracuda Mail Spam/Virus Firewall, and HBSS.
Availability to work in a 24/7 shift environment, with 10-hour shifts running Monday–Thursday or Friday–Monday and rotating every three months.

Responsibilities

Provide Tier II cybersecurity support in a Security Operations Center.
Conduct vulnerability assessments, analyze cyber threats, monitor the email gateway, and report confirmed or suspicious activity.
Collaborate with Tier I and Tier II personnel to provide customer support and assist with training SOC Analyst I team members when needed.
Use intrusion detection technologies and techniques to identify host- and network-based intrusions.
Create, update, resolve, and document Tier II incident tickets and alerts in the ticketing system.
Review asset discovery and vulnerability assessment data, as well as trouble tickets generated by Tier I.
Lead incidents from alert to resolution, using threat intelligence to identify affected systems and determine attack scope.
Collect and review system asset data, including logs, configurations, and running processes, for investigation.
Determine and direct remediation and recovery efforts, including tasking IHT1 as needed.
Request engineering, forensics, or threat intelligence support as appropriate.
Inform and brief the CSOC manager, CISO, DCIO, or CIO on incident status.
Manage and configure security monitoring tools such as SIEM, IDS, firewalls, and access control lists as needed to mitigate threats and vulnerabilities.
Review threat intelligence, create notifications, and share them with specified personnel.
Design incident response for cloud service models and perform damage assessments.
Preserve evidence integrity according to standard operating procedures or national standards.
Protect networks using measures such as NIPS, anti-malware, restrictions on external devices, and spam filters.
Recognize and categorize vulnerabilities and associated attacks; secure network communications and use security event correlation tools.
Identify, capture, contain, and report malware.
Use SOC standard operating procedures to perform daily tasks, resolve incidents, and preserve evidence integrity; provide input to and assist with procedure updates.
Handle other tasks appropriate to Tier II experience and capabilities.