SOC Analyst

ECS Tech Inc•Work from home, Virginia

1d•Remote

About The Position

Everforth ECS Federal is seeking a SOC Analyst to work remotely. At Everforth ECS Federal, we're driven by a commitment to excellence and innovation in solving complex challenges. As a premier provider of advanced technology solutions and services, our mission is to secure and optimize the most critical commercial, government, defense, and intelligence projects across the country. Our team is composed of dynamic professionals who thrive in a collaborative and empowering environment, where our team members leverage the latest technologies and insights to make a real-world impact. Join us and be part of a forward-thinking organization that values your expertise and supports your professional growth. The SOC Analyst is responsible for enterprise security monitoring, alert investigation, and incident response activities within the Everforth Security Operations Center (SOC). This role supports the continuous monitoring of enterprise systems and security telemetry to identify potential threats and suspicious activity. SOC Analysts perform investigative analysis of security alerts, participate in incident response activities, and contribute to detection engineering efforts that improve the organization's ability to detect malicious activity. This role reports to the SOC Manager and works closely with Senior SOC Analysts, the Security Engineering team, enterprise IT operations teams, and the MSSP to ensure effective monitoring, investigation, and response across the enterprise environment.

Requirements

Minimum of 3–5 years of cybersecurity experience, with experience in security operations, threat monitoring, or incident response environments.
Experience monitoring security alerts and investigating suspicious activity using enterprise security tools.
Ability to analyze security alerts, logs, and telemetry to determine potential malicious activity.
Experience working with enterprise security tools such as SIEM platforms, endpoint detection and response (EDR), and log analysis tools.
Experience reviewing system logs, authentication activity, endpoint telemetry, and network security events.
Understanding of basic incident response processes and investigation workflows.
Familiarity with common attacker techniques and indicators of compromise.
Familiarity with cybersecurity frameworks such as NIST Cybersecurity Framework or CIS Critical Security Controls.
Experience documenting investigations and response actions in case management platforms.
Able and willing to obtain a US Security Clearance.
This role may require occasional on-call support during off-hours to respond to security incidents.

Responsibilities

Monitor enterprise security telemetry and alerts generated by security platforms to identify potential threats or suspicious activity.
Conduct investigations of security alerts to determine legitimacy, scope, and potential impact to enterprise systems.
Identify indicators of compromise, malicious behavior, and suspicious activity within enterprise environments.
Support investigation and response activities during confirmed or suspected cybersecurity incidents.
Analyze security telemetry, logs, and alerts to determine attacker behavior, indicators of compromise, and potential attack vectors.
Contribute to the development and refinement of detection rules and monitoring analytics based on investigation findings.
Participate in proactive threat hunting activities to identify adversary behavior that may not be detected through automated monitoring.
Review and investigate alerts escalated by the MSSP after-hours monitoring team.
Document investigations, findings, and response actions within the SOC case management platform.
Contributes to SOC process improvements by supporting automation efforts, implementing AI-assisted workflows, identifying efficiency opportunities, and helping enhance detection and response operations.
Execute SOC operational playbooks and investigation procedures during alert triage and incident response.
Work closely with IT operations, infrastructure teams, and security engineering to support investigation and remediation activities.
Identify opportunities to improve monitoring coverage, investigation processes, and detection capabilities.
Participates in on-call support to assist with security incident response, operational issues, and investigation activities to maintain continuous SOC coverage and response capability.