SOC Analyst

Peraton•,

1d•$80,000 - $128,000•Remote

About The Position

Peraton is seeking a SOC Analyst to support its Department of State Bureau of Diplomatic Technology Consular Affairs Enterprise Infrastructure Operations (CAEIO) program. CAEIO provides IT operations and maintenance to modernize legacy networks, applications, and databases that support consular applications and services globally. The position is fully remote, with preference for candidates local to the Washington, DC, metropolitan area for occasional onsite meetings, training, or customer support in Washington, DC, or Sterling, VA. Onsite frequency may change based on government or program needs, potentially requiring five days per week onsite during surge support. The core schedule requires flexibility to work first, second, and third shifts. The SOC Analyst monitors and investigates alerts, hunts for threats, analyzes network and log activity, and supports incident response and forensic investigations. The role also develops SPL queries, uses SIEM and EDR tools, documents and improves SOC policies and processes, advises on technology risks, prepares reports, and trains junior team members. The analyst collaborates with internal and external teams and contributes to SOC projects and initiatives.

Requirements

Bachelor’s degree and 5 years of experience, an associate degree and 7 years of experience, or a high school diploma or equivalent and 9 years of experience.
U.S. citizenship and an active SECRET security clearance.
At least 3 years of cybersecurity, SOC, or systems security experience in a federal government environment supporting business-critical, high-availability systems.
At least 3 years of SOC or cybersecurity-related experience.
Experience working with a SIEM platform, preferably Splunk.
Experience using Splunk dashboards and Microsoft Sentinel for security monitoring and analysis.
Experience querying and analyzing security data, including SPL, with a working understanding of data types, conditions, and regular expressions.
Working knowledge of system, network, and application security threats and vulnerabilities, and ability to support development and improvement of monitoring solutions.
Understanding of Boolean logic and event correlation.
Experience identifying logging and monitoring gaps and supporting efforts to improve security monitoring.
Working knowledge of cybersecurity incidents, anomaly analysis, log analysis, digital forensics, and common threat vectors.
Understanding of TCP/IP, UDP, network ports, protocols, and traffic flow.
Security+ CE or another DoD 8570 IAT Level II certification.
Familiarity with cybersecurity frameworks and specifications, including RMF and NIST standards such as NIST SP 800-53.

Nice To Haves

Experience with Splunk data normalization, including field aliases, calculated fields, and field extractions.
Splunk Power User certification or higher.
Experience tracking incidents using the MITRE ATT&CK framework.
Knowledge of cloud security.
Experience with system administration, networking, and operating system hardening techniques.
Experience with both Linux and Windows operating systems.
Experience troubleshooting storage-related issues.
Scripting or coding experience.
Knowledge of Web Application Firewall (WAF) security features.

Responsibilities

Monitor and investigate security alerts, perform threat hunting, and notify designated managers, cyber incident responders, and cybersecurity service provider personnel about suspected incidents.
Clearly communicate event history, status, and potential impact in accordance with the organization’s cyber incident response plan.
Analyze and characterize network traffic to identify anomalous activity and potential threats to network resources.
Create advanced ad hoc SPL queries.
Coordinate with internal and external teams to investigate threats, assess risks, and conduct forensic analysis.
Review and analyze host, network traffic, firewall, and IDS logs to identify potential security threats.
Use SIEM and EDR tools to monitor the operational environment.
Develop and document configuration standards, policies, and procedures for operating, managing, and securing system infrastructure.
Advise management and team members on technology risks and recommend mitigation strategies.
Provide technical expertise and thought leadership to multiple levels of management.
Prepare reports detailing investigations, incidents, and other security-related activities.
Identify and classify attack tactics and techniques.
Recommend and implement enhancements to improve system performance, security, and reliability.
Build and refine SOC processes and procedures, including documenting work in SOPs.
Train and mentor junior SOC team members.
Plan and execute SOC-related projects and initiatives.
Communicate clearly and professionally with managers and colleagues.
Take on additional responsibilities as needed.

Benefits

Medical benefits
Dental insurance
Vision insurance
Life insurance
Health savings account
Short- and long-term disability
Employee Assistance Program (EAP)
Parental leave
401(k)
Paid time off (PTO) for vacation
Company-paid holidays
Potential eligibility for overtime, shift differential, and a discretionary bonus