SOC Analyst

DMI • Crownsville, MD

6d • $84,774 - $105,968 • Hybrid

About The Position

DMI is seeking a Security Operations Center (SOC) Analyst to monitor, detect, and analyze cybersecurity threats and events, identify validated intrusion activity, and help defend client environments. The role monitors network and system security events, hunts for threats in event data and activity logs, develops alarms for suspicious or malicious activity, escalates alerts to clients, and prepares reports on detected activity. The analyst also executes and helps develop consistent operational processes for monitoring client environments and supports the Incident Response Team with monitoring and analysis during incident management engagements.

The position works a mid shift, 3:00 p.m.–11:30 p.m., five days per week on a fixed Sunday–Thursday or Tuesday–Saturday schedule. Scheduled State holidays must be worked. The role is based in Crownsville, Maryland, with a hybrid arrangement: Monday–Thursday onsite, and Friday–Sunday and State holidays remote, based on assigned workdays. Applicants must be U.S. citizens and successfully complete a fingerprint background investigation. Physical requirements are not required.

Requirements

• 5–8 years of experience.
• Bachelor’s degree from an accredited college or university in computer science, information systems, engineering, business, or a related scientific or technical discipline.
• CompTIA CySA+, or CompTIA Security+ (or another relevant IAT Level II/III certification) together with one of the listed certifications: CEH, CFR, CCNA Cyber Ops, CCNA-Security, GCIA, GCIH, GICSP, Cloud+, SCYBER, or PenTest+.
• Experience analyzing intrusion events such as phishing emails, malware, privilege misuse, potential DoS/DDoS activity, brute-force activity, and data loss through exfiltration or inadvertent disclosure.
• Applied experience with threat analysis models or frameworks such as Cyber Kill Chain, MITRE ATT&CK, Diamond Model, or Pyramid of Pain.
• Working knowledge of advanced threat tactics, techniques, and procedures (TTPs).
• Applied experience analyzing network traffic with tools such as Wireshark.
• Applied experience with open-source threat research tools or platforms such as VirusTotal.
• Working knowledge of network and security architecture principles such as defense in depth.
• Experience with security protection and detection tools, including firewalls, host and network IDS/IPS, antivirus, EDR, URL filtering gateways, email filtering gateways, DLP tools, and SIEM tools such as Splunk.
• Ability to work independently, establish priorities, and manage task completion within set SLAs.
• Ability to communicate effectively in writing, speaking, and presentations to client technical representatives.
• Ability to contribute productively as a team member in a dynamic, growing, and changing environment.
• U.S. citizenship is required.
• Successful completion of a fingerprint background investigation.

Nice To Haves

• Master’s degree.
• Mid-to-advanced malware analysis experience.
• Experience creating detailed queries and scripts, such as regular expressions, for log, event, and correlation analysis.
• Scripting experience in Python, PowerShell, or VBScript.

Responsibilities

• Monitor, protect, and defend the enterprise perimeter against malicious network traffic.
• Monitor, protect, and defend internal networks and hosts against ongoing and emerging threats.
• Enrich monitoring logs with contextual operational data, correlate events, and identify security issues, threats, and vulnerabilities.
• Analyze and validate security events; triage validated incidents; perform initial containment where feasible; research incidents; enrich case documentation; and escalate incidents for further analysis, containment, and eradication.
• Review threat intelligence and proactively search application, system, and network logs to hunt for and thwart identified threats.
• Prepare and perform shift handover briefings that communicate completed and pending activities and situational awareness information.
• Contribute to the development and maintenance of SOC Standard Operating Procedures (SOPs) and Concept of Operations (CONOPS).
• Participate in post-incident activities and contribute to lessons learned to improve security operations.
• Support preparation of management threat reports and briefings, including recommendations.
• Provide technical recommendations to enable remediation of security issues.
• Partner with security engineering to develop and refine SIEM correlation rules.
• Use advanced threat models, SIEM use cases, and incident response playbooks.
• Work five days per week on a fixed Sunday–Thursday or Tuesday–Saturday schedule, including State holidays when scheduled.

Benefits

• Virtual health visits, commuter perks, pet insurance, and entertainment discounts.
• Annual performance reviews, tuition assistance, and internal career growth opportunities.
• 401(k) matching, life and disability insurance, and financial wellness tools.
• Annual awards, service anniversaries, referral bonuses, and peer-to-peer recognition.
• Healthcare coverage, wellness programs, flu shots, and biometric screenings.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level