SOC Analyst

Northern Technologies Group, Inc.•Alexandria, VA

3h•$150,000 - $165,000•Onsite

About The Position

Northern Technologies Group (NTG) is seeking a highly motivated Security Operations Center (SOC) Analyst to support a mission-critical cybersecurity operations environment. The SOC Analyst will be responsible for monitoring, analyzing, investigating, and responding to cybersecurity events and incidents across enterprise networks and systems. This role requires experience in incident response, cyber defense operations, threat detection, and security monitoring within a Security Operations Center (SOC). The ideal candidate will possess strong analytical skills, experience working with enterprise security tools, and a deep understanding of cyber threat actor tactics, techniques, and procedures (TTPs).

Requirements

Must be a U.S. Citizen.
Must possess an active DoD Top Secret/SCI security clearance.
Bachelor's degree and 8+ years of relevant experience. Additional military service and relevant experience may substitute for degree requirements. Candidates without a degree must possess a minimum of 12 years of relevant experience.
Minimum 2 years of incident handling and incident response experience.
Minimum 2 years of Security Operations Center (SOC) experience.
Experience supporting Cyber Network Defense (CND) operations within a Computer Incident Response organization.
Demonstrated understanding of cyber threat lifecycles, attack vectors and exploitation methodologies, and adversary tactics, techniques, and procedures (TTPs).
Strong knowledge of TCP/IP networking, network protocols and ports, traffic analysis, system administration, OSI model, and defense-in-depth security principles.
Ability to work independently in a fast-paced operational environment.
Demonstrated ability to independently investigate complex or previously unseen cybersecurity incidents by applying analytical problem-solving beyond established playbooks and standard operating procedures.
Experience developing, updating, or improving incident response playbooks, standard operating procedures (SOPs), detection use cases, or investigative workflows, with the ability to recommend appropriate containment, eradication, and recovery actions for suspected compromised systems.
Ability to articulate a structured incident investigation methodology, including alert triage, evidence collection, attack scoping, containment, eradication, recovery, and post-incident analysis.
DoD 8570 IAT Level II (or higher) certification prior to start date (CompTIA Security+, SSCP, etc.).
Must obtain a DoD 8570 CSSP-Analyst certification within six months of hire (e.g., CEH, CySA+, GCIA).

Nice To Haves

Experience analyzing large volumes of: Security logs, NetFlow data, Full Packet Capture (PCAP), Network forensic artifacts
Hands-on experience with enterprise SIEM platforms such as: Splunk, ArcSight, QRadar, McAfee Enterprise Security Management (Nitro), LogLogic.
Experience with: IDS/IPS technologies, Host-Based Security Systems (HBSS), Endpoint security tools, Malware analysis techniques
Unix/Linux command-line proficiency.
Scripting or programming experience.
Familiarity with: MITRE ATT&CK Framework, Cyber Kill Chain Methodology, Intelligence-Driven Defense concepts

Responsibilities

Monitor and analyze security alerts generated from endpoints, IDS/IPS systems, NetFlow data, SIEM platforms, EDR solutions, and other enterprise security monitoring tools.
Identify, investigate, and respond to cybersecurity incidents and suspected system compromises across customer networks, endpoints, cloud environments, and enterprise infrastructure.
Perform detailed analysis of large-scale log data and correlate information from multiple security sources to determine attack scope, root cause, and operational impact.
Conduct complex investigations involving malware, phishing, insider threats, credential compromise, lateral movement, persistence mechanisms, and other advanced cyber threats.
Independently investigate novel or complex cybersecurity incidents that fall outside established playbooks by applying sound technical judgment and analytical problem-solving.
Recommend appropriate containment, eradication, recovery, and post-incident response actions for suspected or confirmed compromised systems based on investigative findings and operational risk.
Escalate validated threats and incidents to senior SOC personnel while providing comprehensive technical analysis, supporting evidence, and recommended courses of action.
Document investigative findings, response actions, root cause analyses, and recommendations within case management and knowledge management systems.
Create, maintain, and distribute incident reports, after-action reports, and executive summaries to customers, stakeholders, and leadership.
Support Cyber Network Defense (CND) operations through protection, detection, response, threat hunting, and sustainment activities.
Develop, update, and improve incident response playbooks, standard operating procedures (SOPs), and investigative workflows based on lessons learned, emerging threats, and evolving adversary tactics.
Contribute to the development and tuning of detection logic, SIEM correlation rules, and response procedures to improve SOC effectiveness and reduce false positives.
Maintain awareness of emerging cyber threats, attack vectors, adversary tactics, techniques, and procedures (TTPs), and apply threat intelligence to ongoing investigations.
Participate in shift operations supporting a 24x7 mission-essential environment.
Contribute to knowledge sharing, mentoring, analyst training, and continuous improvement initiatives to strengthen SOC capabilities and operational readiness.