Tier II Security Operations Center (SOC) Analyst

Type of Requisition

Public Trust/Other Required

US Citizenship Required

RESPONSIBILITIES

• As a Tier II Security Operations Center Analyst, you will:
• Advanced Incident Response: Conduct deep-dive analysis, containment, and remediation of escalated security events and complex cyberattacks.
• AI & Automation Integration: Utilize and tune AI-driven security tools, Machine Learning (ML) models, and SOAR (Security Orchestration, Automation, and Response) playbooks to streamline alert triaging and reduce false positives.
• Proactive Threat Hunting: Design and execute threat-hunting hypotheses across network, host, and cloud environments to uncover sophisticated threats that bypass traditional defenses.
• Analytical Log Correlation: Analyze and correlate complex datasets from SIEM, EDR, XDR, and cloud environments to reconstruct attack chains and identify root causes.
• Threat Intelligence Utilization: Operationalize tactical threat intelligence to proactively block emerging threats and update detection signatures.
• Continuous Improvement: Collaborate with Tier III analysts and engineers to refine detection rules, automate repetitive tasks, and improve overall SOC efficiency.
• Mentorship: Assist in the professional development of Tier I analysts by providing technical guidance and reviewing escalated tickets.

REQUIRED QUALIFICATIONS

• You MUST have:
• Technical Training, Certification(s) or Degree in Cybersecurity, Computer Science, or equivalent technical work experience
• 3 or more years of demonstrated experience in a SOC or dedicated incident response role
• CompTIA Security+ certification (or equivalent DoD-approved baseline certification) required for Tier 2 SOC Analyst duties
• Proven ability to analyze complex data sets, recognize anomalous patterns, and deduce attacker intentD
• Demonstrated experience utilizing AI-powered cybersecurity platforms (e.g., Copilot for Security, AI-driven EDR/XDR) or leveraging LLMs for log analysis and script generation.
• Demonstrated experience utilizing of the MITRE ATT&CK framework, the OSI model, TCP/IP protocols, and cloud security architectures (AWS, Azure, or GCP).
• Advanced hands-on experience with SIEM and security technologies, including Splunk, Microsoft Defender EDR/XDR, Microsoft Intune and Entra ID, Palo Alto Networks, and enterprise log aggregation and analysis platforms.
• Working knowledge of NIST, FISMA, FedRAMP, and DoD cybersecurity policies and frameworks, with the ability to apply applicable security controls, procedures, and requirements to day-to-day SOC operations.
• Must be able to pass a full background check 6C to obtain the required determination for a position of Public Trust.
• Must be a US Citizen

Work Environment

T elecommuting Options

About Our Work