cyber incident handler

General Dynamics Information Technology

<p></p><div><div><div><p>Your Impact</p><p>
Own your opportunity to serve as a critical component of our nation&rsquo;s safety and security. Make an impact by using your expertise to protect our country from threats.</p><p>
Job Description</p><div><div>
SOC ANALYST<br>
<br>
Advance your career while impacting our national security in cyber as a SOC Analyst Principal at GDIT. Here, technologists have many paths to grow a meaningful career supporting cyber missions and operations across the federal government.<br>
<br>
WHAT YOU&rsquo;LL NEED TO SUCCEED<br>
Bring your cyber expertise and drive for innovation to GDIT. The SOC Analyst Principal must have:<br>
<ul><li>Education: Technical Training, Certification(s) or Degree</li><li>Experience: 4+ years of related experience</li></ul></div><p></p><p>
Required certs:</p><p>
IAT II</p><p>
CSSP Analyst</p><p>
GMON</p><p>
SCCU</p><div><br>
GDIT IS YOUR PLACE<br>
At GDIT, the mission is our purpose, and our people are at the center of everything we do.<br>
<ul><li>Growth: AI-powered career tool that identifies career steps and learning opportunities</li><li>Support: An internal mobility team focused on helping you achieve your career goals</li><li>Rewards: Comprehensive benefits and wellness packages, 401K with company match, and competitive pay and paid time off</li><li>Community: Award-winning culture of innovation and a military-friendly workplace</li></ul><br>
OWN YOUR OPPORTUNITY<br>
Explore a career in cyber at GDIT and you&rsquo;ll find endless opportunities to grow alongside colleagues who share your focus on defending and protecting what matters.</div><p></p><p>
#VA_2026Alumni
</p><p></p><p>#MD_2026Alumni</p>
</div></div><div><div><div><p>Work Requirements</p></div></div><div></div><div><div>
Years of Experience<div>
8 + years of related experience</div><ul><li>may vary based on technical training, certification(s), <i>or</i> degree</li></ul></div><div></div><div>
Certification</div><p></p><div>
Travel Required<div>
Less than 10%</div></div><div></div><div>
Citizenship<div>
U.S. Citizenship Required</div></div></div></div></div><div><p>
Salary and Benefit Information</p><div>
The likely salary range for this position is $110,500 - $149,500. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.<br>
View information about benefits and our total rewards program.</div><p>
About Our Work</p><div>
We are GDIT. A global technology and professional services company that delivers technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across over 50 countries worldwide, offering leading capabilities in digital modernization, AI/ML, cloud, cyber and application development. Together with our customers, we strive to create a safer, smarter world by harnessing the power of deep expertise and advanced technology.</div><div>
Join our Talent Community to stay up to date on our career opportunities and events at gdit.com/tc.</div><div><i>
Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans</i></div></div></div>

Cyber SOC Incident Detector (MIDS Shift) - TS/SCI with Polygraph

cFocus Software Incorporated

<div><h1 class="jobSectionHeader"><b>Cyber Threat Intelligence Analyst Job Description</b></h1><b>
Position: </b>Cyber Threat Intelligence Analyst<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services.<br>
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul><p>
</p><p>Pw75tUj9Bf</p></div>

SBA - Cyber Threat Intelligence Analyst

<div><h1 class="jobSectionHeader"><b>Digital Forensics Engineer Job Description</b></h1><b>
Position Title: </b>Digital Forensics Engineer<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Digital Forensics Engineer supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by providing advanced digital forensics, incident response, cyber investigation, evidence preservation, malware analysis, and e-discovery support services.<br>
The Digital Forensics Engineer conducts complex forensic examinations involving workstations, servers, cloud platforms, mobile devices, email systems, network traffic, and enterprise applications in support of cybersecurity investigations, incident response activities, insider threat investigations, legal support actions, and enterprise cyber defense operations. The role supports 24x7x365 Security Operations Center (SOC) functions and coordinates closely with federal stakeholders, incident responders, threat hunters, legal teams, privacy personnel, and law enforcement partners.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Perform advanced digital forensic analysis and investigations in support of SBA ECS cybersecurity operations requirements.</li><li>
Support Task Areas 3.5.3 and 3.5.3.6 by conducting forensic examinations related to cybersecurity incidents, insider threats, malware infections, unauthorized access, and data exfiltration.</li><li>
Collect, preserve, analyze, and document digital evidence in accordance with federal forensic standards and chain-of-custody procedures.</li><li>
Perform host-based, network-based, cloud-based, and mobile device forensic investigations across enterprise environments.</li><li>
Conduct forensic acquisition and analysis of Windows, Linux, macOS, cloud, virtualized, and hybrid systems.</li><li>
Analyze endpoint telemetry, security logs, network packet captures (PCAP), SIEM data, and forensic artifacts to identify indicators of compromise (IOCs) and adversary activity.</li><li>
Support incident response activities by reconstructing attack timelines, determining root cause, identifying attack vectors, and assessing operational impact.</li><li>
Perform malware analysis and reverse engineering support activities to identify malicious behaviors, persistence mechanisms, and command-and-control communications.</li><li>
Support e-discovery operations including collection, indexing, preservation, processing, and review of electronically stored information (ESI).</li><li>
Conduct forensic examinations supporting legal, Inspector General (IG), Human Resources (HR), insider threat, privacy, and law enforcement investigations.</li><li>
Utilize forensic and cyber defense tools including EnCase, FTK, Velociraptor, Wireshark, Volatility, Splunk, Microsoft Defender, Sentinel, and endpoint detection and response (EDR) platforms.</li><li>
Perform memory analysis, disk analysis, registry analysis, browser artifact analysis, and log correlation activities.</li><li>
Develop forensic reports, technical findings, evidentiary documentation, executive briefings, and remediation recommendations.</li><li>
Maintain detailed forensic documentation, evidence handling procedures, and chain-of-custody records.</li><li>
Support cybersecurity monitoring, detection, containment, eradication, and recovery activities within the SOC environment.</li><li>
Coordinate with SOC analysts, incident responders, threat hunters, engineers, and federal stakeholders during cyber investigations and breach response activities.</li><li>
Support continuous improvement of forensic methodologies, investigative procedures, and cybersecurity operational capabilities.</li><li>
Assist with the development and maintenance of digital forensic playbooks, standard operating procedures (SOPs), and incident handling guidance aligned with NIST SP 800-61 and NIST SP 800-86.</li><li>
Research emerging cyber threats, adversary tactics, techniques, and procedures (TTPs), and evolving forensic technologies.</li><li>
Support federal cybersecurity compliance requirements, reporting activities, and operational readiness initiatives.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Digital Forensics, Information Assurance, Information Technology, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 8 years of experience supporting digital forensics, cyber investigations, incident response, cybersecurity operations, or Security Operations Center (SOC) environments.</li><li>
Hands-on experience conducting enterprise-level forensic investigations and evidence analysis.</li><li>
Experience with forensic acquisition and analysis tools including EnCase, FTK, X-Ways, Velociraptor, Volatility, or equivalent technologies.</li><li>
Experience analyzing Windows, Linux, cloud, mobile, and network forensic artifacts.</li><li>
Knowledge of incident response methodologies, MITRE ATT&amp;CK framework, cyber kill chain concepts, and adversary TTP analysis.</li><li>
Experience supporting legal hold, e-discovery, insider threat, and regulatory investigation activities.</li><li>
Experience with SIEM, EDR, IDS/IPS, packet analysis, and security monitoring technologies.</li><li>
Strong understanding of NIST cybersecurity standards including NIST SP 800-61 and NIST SP 800-86.</li><li>
Ability to prepare technical forensic reports and present investigative findings to technical and executive stakeholders.</li><li>
Strong analytical, investigative, communication, and technical documentation skills.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
GIAC Network Forensic Analyst (GNFA)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
EnCase Certified Examiner (EnCE)</li><li>
Certified Computer Examiner (CCE)</li><li>
Certified Ethical Hacker (CEH)</li><li>
CompTIA CySA+</li><li>
CompTIA Security+</li><li>
Certified Information Systems Security Professional (CISSP)</li></ul><p>
</p><p>6HY6JyRiD8</p></div>

SBA - Digital Forensics Engineer

NMC Health plc

<div><p>Actively monitor the networks, systems, applications, IT assets and bio-medical equipment&rsquo;s for suspicious activity and threats. Using offensive and defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or may occur within the network and make the initial decision on the event/ threat severity.</p></div>
<br><div><ul><li><p>Manage network, intrusion detection and prevention systems.
</p></li><li><p>Conduct periodic compromise assessments across selected networks and propose recommendations based on assessment results.
</p></li><li><p>Conduct physical security assessment of the organization&rsquo;s systems, including servers and networks, ensuring that any unauthorized external physical interference is not actually possible.
</p></li><li><p>Conduct ongoing network hunt activities.
</p></li><li><p>Conduct proactive vulnerability assessment across the network, subnetworks and service traffic to identify potential points of intrusion.
</p></li><li><p>Research and develop methods of tracking and detecting malicious activity within a network.
</p></li><li><p>Develop tools, signatures, and methods of detection for use in incident response activities.
</p></li><li><p>Develop SIEM integrations, dashboards, and analytics to illuminate and visualize threat activity.
</p></li><li><p>Analyze network traffic to provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.
</p></li><li><p>Uses data collected from a variety of cyber defense tools (e.g., anti-virus, IDS alerts, firewalls, network traffic logs) to analyze events that occur within their environments, perform cyber defense trend analysis and reporting, and perform event correlation to mitigate threats and gain situational awareness and determine the effectiveness of an observed attack.
</p></li><li><p>Carries out triage to ensure that a genuine security incident is occurring.
</p></li><li><p>Coordinate with entity-wide cyber defense staff to validate network alerts.
</p></li><li><p>Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event&rsquo;s history, status, and potential impact for further action in accordance with the organization&rsquo;s cyber incident response plan.
</p></li><li><p>Document and escalate incidents (including event&rsquo;s history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.
</p></li><li><p>Provide daily summary reports of network events and activity relevant to cyber defense practices.
</p></li><li><p>Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.
</p></li><li><p>Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.
</p></li><li><p>Isolate and remove malware.
</p></li><li><p>Develop content for cyber defense tools use them for continual monitoring and analysis of network activity to identify malicious activity.
</p></li><li><p>Assist in the construction of signatures which can be implemented on cyber defense tools in response to new or observed threats within the network environment.
</p></li><li><p>Analyze and report organizational security posture trends.
</p></li><li><p>Monitor external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus, Threat Intelligence Providers) to maintain updated of cyber defense threat condition and determine which security issues may have an impact on the enterprise.
</p></li><li><p>Provides cybersecurity recommendations based on significant threats and vulnerabilities.
</p></li><li><p>Provide advice and input for Disaster Recovery, Contingency, and Continuity of Operational Plans.
</p></li><li><p>Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber incidents within the enterprise.
</p></li><li><p>Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence.
</p></li></ul><p>Utilize deployable forensics toolkit to support operations as necessary</p></div>
<br><div><p><b>Knowledge
</b></p><ul><li><p>Security concepts such as cyber-attacks and techniques, threat vectors, risk and threat management, incident management etc.
</p></li><li><p>Networking concepts and protocols, and network security attacks, vulnerabilities, processes, methodologies, access control mechanisms, traffic analysis methods.
</p></li><li><p>Cyber threats and vulnerabilities and information dissemination sources (e.g., alerts and advisories).
</p></li><li><p>Cyber defense and vulnerability assessment tools and their capabilities.
</p></li><li><p>System and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
</p></li><li><p>Scripting languages (e.g., Python, Perl, Bash) used in an incident response environment
</p></li><li><p>Incident response and handling methodologies.
</p></li><li><p>Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools, applications, methodologies and techniques for detecting host and network-based intrusions.
</p></li><li><p>Threat investigations, reporting and investigative tools.
</p></li><li><p>Cyber defense and information security policies, procedures, and regulations.
</p></li><li><p>Common attack vectors, the different classes of attacks (e.g., passive, active, insider, close-in, distribution attacks) and attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
</p></li><li><p>Cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored), and attackers&rsquo; methodologies.
</p></li><li><p>Signature implementation impact for viruses, malware, and attacks.
</p></li><li><p>Windows/Unix ports and services.
</p></li><li><p>Relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.
</p></li><li><p>Packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
</p></li><li><p>Use of sub-netting tools.
</p></li><li><p>Penetration testing principles, tools, and techniques.
</p></li><li><p>Investigation, auditing and forensics methods, processes, procedures and standards.
</p></li><li><p>Different types of hardware, storage, imaging and file system analysis.
</p></li><li><p>Data backup and recovery.
</p></li></ul><p><b>Skills
</b></p><ul><li><p>Using SIEM/SOAR and Vulnerability Management tools and services.
</p></li><li><p>Sysadmin skills (Linux/Mac/Windows).
</p></li><li><p>Programming skills (Python, Ruby, PHP, C, C#, Java, Perl, and more).
</p></li><li><p>Identifying, analyzing and interpreting trends or patterns in complex data sets.
</p></li><li><p>Developing and deploying signatures.
</p></li><li><p>Detecting host and network-based intrusions via intrusion detection technologies (e.g., Snort).
</p></li><li><p>Using incident handling methodologies.
</p></li><li><p>Collecting data from a variety of cyber defense resources.
</p></li><li><p>Recognizing and categorizing types of vulnerabilities and associated attacks.
</p></li><li><p>Performing packet-level analysis.
</p></li><li><p>Conducting trend analysis.
</p></li><li><p>Using cyber defense reporting structure and processes.
</p></li><li><p>Utilizing a combination of automated and manual testing methods.
</p></li><li><p>Developing automated vulnerability testing scripts and using off the shelf vulnerability testing tools.
</p></li><li><p>Conducting vulnerability scans and recognizing vulnerabilities in networks, systems and applications.
</p></li><li><p>Using of penetration testing tools and techniques.
</p></li><li><p>Applying analytical and problem-solving skills.
</p></li></ul><p><b>Ability
</b></p><ul><li><p>Collaborate with other sections across the department to enhance detection capabilities.
</p></li><li><p>Perform Malware analysis.
</p></li><li><p>Work closely with management to respond appropriately to the results of assessments and mitigation oversight of found vulnerabilities.
</p></li><li><p>Perform data analysis, correlation, and analytics leveraging Security Information and Event Management (SIEM) tools.
</p></li><li><p>Conduct vulnerability scans and recognize vulnerabilities in security systems &amp; devices.
</p></li><li><p>Accurately and completely source all data used in intelligence, assessment and/or planning products.
</p></li><li><p>Apply techniques for detecting host and network-based intrusions using intrusion detection technologies.
</p></li><li><p>Interpret the information collected by network tools (e.g. Nslookup, Ping, and Traceroute).
</p></li><li><p>Prepare and create regular reports to document any security breaches/ incidents.
</p></li><li><p>Provide forensic support to Cyber Security Operations during the investigation of any detected threat or contained incident / event to determine root cause and propose response recommendations as required.
</p></li></ul><p><b>Education and Certification
</b></p><ul><li><p>Bachelor&rsquo;s degree in an information technology, computer science, cyber security or equivalent work experience.
</p></li><li><p>CompTIA Security+
</p></li><li><p>CISSP: Certified Information Systems Security Professional
</p></li><li><p>GCFA: GIAC Certified Forensic Analyst
</p></li><li><p>GCIH: GIAC Certified Incident Handler
</p></li><li><p>GCIA: GIAC Certified Intrusion Analyst
</p></li><li><p>OSCP: Offensive Security Certified Professional
</p></li><li><p>CEH: Certified Ethical Hacker
</p></li><li><p>CPT: Certified Penetration Tester
</p></li></ul><p><b>Experience
</b></p><ul><li><p>3 years of experience in cyber security operations with expertise in managing the Security Operations Center
</p></li><li><p>UAE experience preferred.</p></li></ul></div>

Information Security Specialist

Asyad Group

<p><b>Asyad </b>oversees Oman&rsquo;s logistics ecosystem including ports, shipping, and freight services.</p><p><i>As a </i><i><b>Cyber Security</b></i> <i>at Asyad Group - this role focuses on detecting, investigating, and responding to cyber threats to protect an organization&rsquo;s systems, data, and critical infrastructure.</i></p><p><b>Job Description:</b></p><p><i><b>1. Incident Detection &amp; Response</b></i></p><p>Monitor security alerts using SIEM tools</p><p>Investigate suspicious activities and cyberattacks</p><p>Perform incident triage, analysis, and containment</p><p><i><b>2. Threat Hunting &amp; Monitoring</b></i></p><p>Proactively search for hidden threats in systems</p><p>Analyze logs (firewalls, endpoints, network traffic)</p><p>Use tools like:</p><p>EDR/XDR (e.g., CrowdStrike, SentinelOne)</p><p><i><b>3. Digital Forensics &amp; Investigation</b></i></p><p>Conduct malware analysis and forensic investigations</p><p>Identify root cause of incidents</p><p>Assess scope and impact of breaches</p><p><i><b>4. Containment &amp; Recovery</b></i></p><p>Isolate affected systems</p><p>Remove threats and restore operations</p><p>Develop remediation plans</p><p><i><b>5. Documentation &amp; Reporting</b></i></p><p>Create incident reports and post-mortem analysis</p><p>Recommend security improvements</p><p>Maintain incident logs and compliance records</p><p><i><b>6. Collaboration</b></i></p><p>Work with:</p><p>SOC (Security Operations Center) teams</p><p>IT and network teams</p><p>External cybersecurity vendors</p><p>7. Security Improvement</p><p>Improve incident response processes</p><p>Develop playbooks and automation</p><p>Stay updated on emerging cyber threats</p><p><b>Requirements:</b></p><p>Bachelor&rsquo;s degree in IT, Cybersecurity, or related field</p><p>Certifications (preferred):</p><p>CISSP</p><p>CEH</p><p>CompTIA CySA+ / Security+</p><p>Experience:</p><p>2&ndash;5 years (junior-mid)</p><p>5+ years (senior roles)</p><p>Job Type: Full-time</p><p>Pay: From RO1,500.000 per month</p><p>Work Location: In person</p>

Cybersecurity / Incident Response Specialist (Asyad Group)

Openkyber

<div><b>Job id:</b> 801624<br>
<b>SOC Analyst- Endpoint Detection &amp; Response</b><br>
<b>Client:</b> IA DOM DOIT<br>
<b>Location:</b> Remote, Des Moines, IA<br>
<b>Duration:</b>
<p>Job Description: The State of Iowa is seeking an experienced Security Operations Center (SOC) Analyst with strong expertise in Endpoint Detection and Response (EDR) tools and cyber-security incident handling.</p>
<p>Position Summary: The State of Iowa is seeking an experienced Security Operations Center (SOC) Analyst with strong expertise in Endpoint Detection and Response (EDR) tools and cyber-security incident handling. The ideal candidate will thrive in a fast-paced environment with aggressive timelines and will be responsible for monitoring, analyzing, and responding to events and alerts supporting statewide IT systems. This is a remote position.</p>
<b>Required Experience:</b>
<p>3 Hands-on experience working with Endpoint Detection and Response (EDR) tools Experience responding to, and analyzing, cyber-security events and incidents Experience working with Crowdstrike, or comparable EDR tool Ability to work in high-pressure, fast-paced environments Experience working with CrowdStrike or comparable EDR tool</p>
<b>Responsibilities:</b>
<ul><li>Provide security monitoring and response efforts for, and in coordination with, the Security Operations Center (SOC)</li>
<li>Lead outreach and coordination with statewide partners, including County, Municipal, and educational entities</li>
<li>Strong communication, reporting, and documentation abilities Monitor, analyze, and respond to cyber-security events, alerts, and incidents affecting State of Iowa IT systems</li>
<li>Take appropriate actions to protect IT assets from potential incidents and threats</li>
<li>Document and report changes, trends, and implications related to evolving cyber-security tools, systems, and solutions</li>
<li>Follow SOC processes and assist ISD Security Engineers and OCIO support teams during alerts, events, and incidents</li>
<li>Submit new events and update existing events within the SOC ticketing system</li>
<li>Provide phone and email support to state agencies and participating partners during alerts, events, and incidents</li>
<li>Provide off-hours or ad-hoc shift support as required Proven ability to collaborate effectively with partners across varying technical backgrounds</li>
<li>Capability to perform Tier 1 troubleshooting, including log collection, documentation review, and appropriate escalation</li>
<li>Maintain up-to-date knowledge on relevant cyber-security technologies and tools</li>
<li>Support Tier 1 SOC Analysts in triaging cyber-security events, alerts, and incidents</li>
<li>Follow detailed operational procedures to analyze, escalate, and support remediation of critical security incidents</li>
<li>Assist with SOC metrics, reporting, and communications</li>
<li>Support incident response activities up to the preliminary forensics stage</li>
<li>Monitor EDR tools and perform initial assessment and data gathering for alerts</li>
</ul><p><b>For applications and inquiries, contact:</b> hirings@openkyber.com</p></div>

SOC Manager

Cyber Force

<div>Cairo, Egypt Hybrid Full-time</div>
<br><div><h2 class="jobSectionHeader"><b>About Cyber Force</b></h2>
<p>
Cyber Force is a cybersecurity consultancy delivering advisory, managed services, and operations to international clients. Our senior-led teams combine governance, engineering, and 24&times;7 response to turn cyber risk into measurable resilience.</p>
<h2 class="jobSectionHeader"><b>
Role Overview</b></h2>
<p>
We are looking for a Junior Cyber Defense Operations Analyst to join our Threat Detection &amp; Response team as a frontline defender. You will monitor, triage, and investigate security alerts across SIEM, EDR, and XDR platforms, perform initial incident analysis, escalate confirmed threats, and maintain shift-based coverage for our managed services clients and on-site engagements. You will also leverage AI-augmented tooling and agentic SOC capabilities that Cyber Force is actively building into its detection and response workflows.</p>
<h2 class="jobSectionHeader"><b>
Key Responsibilities</b></h2>
<ul><li>Monitor security alerts from SIEM (Elastic SIEM, Microsoft Sentinel), EDR/XDR (Defender XDR) across client environments</li>
<li>Triage and investigate alerts: analyze log data, correlate events, identify IOCs, determine true vs. false positives</li>
<li>Perform initial incident response: collect artifacts, preserve evidence, escalate to Tier 2/3 with structured handoff</li>
<li>Execute detection playbooks aligned with MITRE ATT&amp;CK</li>
<li>Analyze network traffic, endpoint telemetry, and identity/authentication logs</li>
<li>Maintain shift logs, case notes, and client-facing incident reports to SLA standards</li>
<li>Contribute to detection engineering: propose rule improvements, tune thresholds</li>
<li>Leverage AI-augmented tooling and LLM-based tools (Claude, ChatGPT) for alert enrichment and report drafting</li>
<li>Validate AI-generated investigation outputs from agentic SOC capabilities</li>
<li>Participate in purple team exercises and continuous training</li>
</ul><h2 class="jobSectionHeader"><b>Requirements</b></h2>
<ul><li>Bachelor&rsquo;s in CS, Cybersecurity, IT, or related (or equivalent practical experience)</li>
<li>0&ndash;1 year experience in SOC, cyber defense, or IT security (internships, labs, CTFs count)</li>
<li>At least one cert: CompTIA Security+, CySA+, BTL1, ISACA CCOA, or equivalent</li>
<li>Fluent English (written and spoken)</li>
<li>Foundational knowledge of SIEM, EDR/XDR, and log analysis</li>
<li>Networking fundamentals: TCP/IP, DNS, HTTP/S, firewalls, proxies, VPNs</li>
<li>Familiarity with MITRE ATT&amp;CK and common adversary TTPs</li>
<li>Demonstrated experience using LLM-based tools (Claude, ChatGPT) &mdash; this is a must</li>
<li>Willingness to work rotating shifts (24/7 coverage) and deploy to client sites</li>
<li>Elastic, Microsoft Sentinel, or Defender XDR experience &mdash; a strong plus</li>
<li>VICI VCDA (Viridian Certified Defense Associate) certification &mdash; a plus</li>
<li>French language skills &mdash; a plus</li></ul></div>
<br><div><h4 class="jobSectionHeader"><b>Role details</b></h4>
<div>Location Cairo, Egypt
</div><div>Type Full-time
</div><div>Mode Hybrid</div></div>

Junior Cyber Defense Operations Analyst

Search 1972+ Cyber incident handler jobs near you this May. New roles added regularly across leading industries. Apply today.