SOC Analyst (5333)

Essential Duties & Responsibilities

• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities


• Implement and manage multiple security tools to include SIEM’s, firewalls, IDS/IPS’s, threat and vulnerability management tools, data loss prevention tools, filtering technologies, traffic inspection solutions, reporting technology and data analytics platforms


• Use cyber defense tools for continual monitoring and analysis of system to identify malicious activity


• Document and escalate incidents (including event’s history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment


• Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information


• Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack


• Conduct research, analysis, and correlation across a wide variety of all source data sets (indications and warnings)


• Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts


• Perform cyber defense trend analysis and reporting


• Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources


• Coordinate with enterprise-wide cyber defense staff to validate network alerts. Identify and analyze anomalies in network traffic using metadata


• Provide daily summary reports of network events and activity relevant to cyber defense practices. Identify applications and operating systems of a network device based on network traffic


• Threat research, OSINT, and classified sources for TTPS, IOCs and signatures for monitoring and alerting. RMF/CONMON support to aid in the mitigation of findings


• Supporting engineering to ensure network designs and operations are secure from inception to production

Required Skills/Experience

• Clearance Required: Top Secret 


• 3-5 years of applicable work experience


• CompTIA Network+ certification


• Operating System certifications 


• One or more of the following industry certifications: GCIA, GCIH, GCDA, GSOC, GCED, CYSA or equivalent certs


• Must be able to maintain DoD-8140 compliance

Desired Qualifications: 

• Linux OS experience