Tier 1 Watch Analyst

Sentar•Charleston, SC

1d•Onsite

About The Position

Sentar is seeking a Tier 1 Watch Analyst in Charleston, South Carolina. The CSSP DCO Watch Analyst identifies, isolates, investigates, and reports suspicious activity, and implements measures to help detect and protect data across a broad range of sources and locations. The analyst validates suspicious events, determines whether they constitute incidents, enters incident information into appropriate reporting systems, and determines incident severity. Reporting and response actions must be taken promptly to meet CJCSM 6510.01B requirements. The role provides endpoint and network intrusion detection and monitoring, correlation analysis, incident response, and support for the Cybersecurity Service Provider (CSSP) and subscriber sites. The analyst maintains internal standard operating procedure documentation and helps ensure documentation and capabilities comply with CJCSM 6510.01B and other applicable directives. Duties include initial alert triage, documenting findings, creating tickets for suspicious activity, and escalating cases to Tier 2 personnel. The analyst also reviews host and network logs, correlates activity using Splunk and supplemental tools, assists with data collection and basic artifact gathering, and identifies recurring benign activity for tuning and whitelisting recommendations. The position supports CSSP incident response outside core business hours as needed, participates in program reviews and product evaluations, and assists with onsite certification evaluations. The analyst contributes to a draft daily operations report on a rotating basis for review and release by the Watch Officer. Operations run 24/7/365 across three regional operation centers, with four ten-hour shifts organized into front-half and back-half schedules. Shift placement is at the discretion of assigned managers. Overtime may be required for incident-response surges, and travel of up to 10% may be required.

Requirements

Secret clearance, with the ability to obtain Top Secret/Sensitive Compartmented Information (TS/SCI).
Bachelor’s degree in Cybersecurity, Computer, Electrical, or Electronics Engineering, or Mathematics with a concentration in computer science, or equivalent; alternatively, a high school diploma/GED and 2+ years of practical experience demonstrating competency in Cybersecurity Engineering, T&E, or A&A/C&A-related work.
DoD 8570 IAT Level II CNDSP Analyst OS/CE certification (FEDVTE Linux OS, FEDVTE Windows OS, or Server+).
At least 2 years of experience in a CSSP environment or similar.
Knowledge of incident-response procedures, packet analysis, IDS/IPS solutions, and CJCSM 6510.01B.
Familiarity with host-based tools and operating-system logging.
Experience with log aggregation tools and digital forensics.
Logical thinking, analytical ability, verbal and written communication ability, and the ability to solve problems independently.
Ability to work within rotating four ten-hour shift schedules supporting 24/7/365 operations.
Ability to travel up to 10% and work overtime as needed for incident-response surges.

Responsibilities

Identify, isolate, investigate, and report suspicious events and implement measures to detect and protect data.
Validate suspicious events or reports, determine whether they constitute incidents, enter associated information into reporting systems, and determine incident severity.
Take timely incident reporting and response measures to satisfy CJCSM 6510.01B requirements.
Compile and maintain internal SOP documentation and ensure documentation and capabilities remain compliant with applicable directives.
Provide endpoint and network intrusion detection and monitoring, correlation analysis, and incident response support for the CSSP and subscriber sites.
Perform initial alert triage, document findings against established standards, create initial tickets for suspicious activity, and escalate them to Tier 2 personnel.
Provide CSSP incident-response support during non-core business hours as needed.
Review host and network logs and explore patterns in network and system activity through log correlation using Splunk and supplemental tools.
Assist with data collection and basic artifact gathering during campaigns as directed by higher tiers.
Identify recurring benign activity and support tuning and whitelisting recommendations to reduce false positives.
Participate in program reviews, product evaluations, and onsite certification evaluations.
Assist with compiling the draft daily operations report on a rotating basis for review and release by the Watch Officer.

Benefits

Voluntary medical, dental, and vision insurance, with flexible spending plan options.
Voluntary life, critical illness, accident, and long-term care insurance options.
Group term life insurance and short- and long-term disability coverage for qualifying employees.
401(k) match.
Paid time off plan that increases with years of service.
Holiday schedule and other leave programs, including bereavement, maternity, jury duty, and military duty leave.
Tuition reimbursement.
Professional development reimbursement.
Recognition and awards programs.
Employee ownership model.