incident response analyst

Alignerr

<div>
 
 Incident Response Analyst (AI Training)
 
 
 
 
 About The Role
 
 
 
 We're partnering with leading AI research labs to build the next generation of AI-powered security tools &mdash; and we need experienced incident responders to help make them real.
 
 
 As an Incident Response Analyst, you'll work with realistic security incident data to evaluate, challenge, and improve AI systems designed to detect threats, correlate alerts, and support digital investigations. Your hands-on experience in security operations is exactly what's needed to make AI smarter and more accurate in this domain.
 
 
 <ul>
 <li>
 Organization: Alignerr
 </li>
 <li>
 Type: Hourly Contract
 </li>
 <li>
 Location: Remote
 </li>
 <li>
 Commitment: 10&ndash;40 hours/week
 
 
 </li>
 </ul>
 
 What You'll Do
 
 
 
 <ul>
 <li>
 Analyze real-world security events, alerts, and incident cases
 </li>
 <li>
 Identify root cause, assess impact, and determine appropriate remediation steps
 </li>
 <li>
 Evaluate detection rules, alerting pipelines, and investigative playbooks for accuracy and effectiveness
 </li>
 <li>
 Review and validate AI-generated incident analysis to ensure it reflects how real SOC teams operate
 </li>
 <li>
 Provide structured, expert feedback that directly shapes how AI handles security investigations
 
 
 </li>
 </ul>
 
 Who You Are
 
 
 
 <ul>
 <li>
 2+ years of hands-on experience in SOC, incident response, or security operations
 </li>
 <li>
 Proficient with SIEM platforms, alert queues, and investigation tooling
 </li>
 <li>
 Skilled at separating meaningful threats from noise in high-volume alert environments
 </li>
 <li>
 Detail-oriented with strong written communication skills
 </li>
 <li>
 Self-motivated and comfortable working independently on async, task-based assignments
 
 
 </li>
 </ul>
 
 Nice to Have
 
 
 
 <ul>
 <li>
 Experience with threat hunting, digital forensics, or malware analysis
 </li>
 <li>
 Familiarity with frameworks like MITRE ATT&amp;CK or NIST IR
 </li>
 <li>
 Background in cloud security, endpoint detection, or network forensics
 </li>
 <li>
 Prior experience in AI data annotation or evaluation workflows
 
 
 </li>
 </ul>
 
 Why Join Us
 
 
 
 <ul>
 <li>
 Work directly on frontier AI systems alongside top research labs
 </li>
 <li>
 Fully remote and flexible &mdash; work on your own schedule
 </li>
 <li>
 Freelance perks: autonomy, variety, and global collaboration
 </li>
 <li>
 Meaningful impact &mdash; your expertise helps define how AI understands cybersecurity
 </li>
 <li>
 Potential for ongoing work and contract extension
 </li>
 </ul>
</div>

Incident Response Analyst

Deepwatch

<div><div>Come join Deepwatch's team of world-class cybersecurity professionals and the brightest minds in the industry. If you're ready to challenge yourself with work that matters, then this is the place for you. We're redefining cybersecurity as one of the fastest growing companies in the U.S. &ndash; and we have a blast doing it!

Who We Are

Deepwatch is the leader in managed security services, protecting organizations from ever-increasing cyber threats 24/7/365. Powered by Deepwatch's cloud-based security operations platform, Deepwatch provides the industry's fastest, most comprehensive detection and automated response to cyber threats together with tailored guidance from dedicated experts to mitigate risk and measurably improve security posture. Hundreds of organizations, from Fortune 100 to mid-sized enterprises, trust Deepwatch to protect their business.

Our core values drive everything we do at Deepwatch, including our approach to tackling tough cyber challenges. We seek out tenacious individuals who are passionate about solving complex problems and protecting our customers. At Deepwatch, every decision, process, and hire is made with a focus on improving our cybersecurity solutions and delivering an exceptional experience for our customers. By embracing our values, we create a culture of excellence that is dedicated to empowering our team members to explore their potential, expand their skill sets, and achieve their career aspirations, which is supported by our unique annual professional development benefit.

Deepwatch recognition includes:
<ul>
<li>2025, 2024, 2023, 2022 and 2021 Great Place to Work&reg; Certified</li>
<li>2024 Military Times Best for Vets Employers</li>
<li>2024 US Department of Labor Hire Vets Gold Award</li>
<li>2024 Forbes' America's Best Startup Employers</li>
<li>2024 Cyber Defense Magazine, Global Infosec Awards</li>
<li>2023 and 2022 Fortress Cybersecurity Award</li>
<li>2023 $180M Series C investment from Springcoast Capital Partners, Splunk Ventures, and Vista Credit Partners of Vista Equity Partners</li>
<li>2022 Cybersecurity Excellence Award for MDR</li>
</ul></div>
Incident Response Analyst

Location: Hybrid,Tampa, FL / Remote

While proximity to Tampa is preferred to support a hybrid schedule in our Tampa Center of Excellence, we're open to remote candidates who can support the Eastern Time Zone.

Reporting to the Manager of Adversary Response, the Incident Response Analyst operates on the front lines of active cyber conflict&mdash;defending organizations against sophisticated, real-world adversaries. This is a mission-critical role for practitioners who thrive in high-pressure environments and are driven to outpace, outthink, and disrupt advanced threat actors. 
As a primary responder during live incident engagements, you will lead hands-on investigations into complex intrusions, leveraging advanced EDR and detection platforms to trace attacker behavior, contain threats in real time, and eradicate adversary presence at its source. 
This role demands sharp analytical instincts, technical depth, and a relentless curiosity&mdash;paired with the discipline to execute under pressure. You won't just respond to incidents; you'll play a key role in defending critical environments, strengthening resilience, and raising the bar against an ever-evolving threat landscape.

In this role, you'll get to:
<ul>
<li>Lead end-to-end incident response engagements within customer environments, driving rapid investigation, containment, and remediation of active threats</li>
<li>Conduct deep-dive forensic and malware analysis to uncover adversary tactics, techniques, and procedures (TTPs), translating findings into actionable intelligence</li>
<li>Proactively hunt for advanced threats through hypothesis-driven threat hunting across diverse data sources and telemetry</li>
<li>Triage and validate suspicious activity using a combination of open-source intelligence (OSINT), proprietary intelligence, and behavioral analysis</li>
<li>Own the documentation of incidents, ensuring clear, defensible reporting and timeline reconstruction within case management systems</li>
<li>Identify and operationalize new adversary techniques, tools, and tradecraft&mdash;scaling knowledge across the team to strengthen collective defense</li>
<li>Maintain a constant pulse on the evolving threat landscape, applying emerging intelligence to real-world investigations</li>
<li>Surface visibility gaps in logging, telemetry, and detection coverage, and partner with stakeholders to enhance overall security posture</li>
<li>Collaborate cross-functionally to develop and refine detection content, response playbooks, and threat intelligence outputs</li>
<li>Serve as a trusted advisor to customers, confidently guiding them through the full incident response lifecycle&mdash;from initial compromise to full remediation and recovery</li>
</ul><div>To be successful in this role, you will bring:</div>
<ul><li>Proven, hands-on experience leading incident response investigations, with the ability to independently scope, analyze, and drive complex engagements to resolution</li>
<li>A track record of operating in high-volume, high-complexity environments (e.g., MDR, MSSP, consulting, or enterprise IR teams), with exposure to a wide range of real-world incidents and adversary scenarios</li>
<li>Deep expertise with Endpoint Detection &amp; Response (EDR) platforms such as SentinelOne, Microsoft Defender, and CrowdStrike, including advanced querying, triage, and response actions</li>
<li>Strong command of incident response methodologies and frameworks (e.g., NIST, PICERL), with the ability to apply them dynamically in fast-moving, ambiguous situations</li>
<li>Experience leveraging SIEM, SOAR, case management, and threat intelligence platforms to investigate, correlate, and respond to threats at scale</li>
<li>A solid understanding of attacker methodologies, including common and emerging tactics, techniques, and procedures (TTPs), with the ability to map activity to frameworks such as MITRE ATT&amp;CK</li>
<li>Exceptional communication skills, with experience presenting technical findings and strategic recommendations to both technical teams and executive stakeholders</li>
<li>The ability to operate as a trusted advisor during high-pressure incidents&mdash;bringing clarity, structure, and confidence to customer engagements</li>
</ul>
Note: This role is best suited for practitioners who have been deeply immersed in live incident response environments and have built pattern recognition across numerous engagements. Candidates with limited exposure to real-world incidents may find the pace, ambiguity, and complexity of this role challenging.

Statutory Pay Disclosure

The anticipated salary range for this role is $127,00 - $140,000 + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:
<ul>
<li>A citizen of the U.S.;</li>
<li>A lawful permanent resident of the United States;</li>
<li>A person admitted to the United States as a refugee; or</li>
<li>A person that has been granted asylum by the United States government.</li>
</ul>
The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.<div><div>

What We Offer:

Deepwatch is excited to provide benefits designed to support team members and their families. Including:
<ul>
<li>Medical, dental, vision, and disability insurance</li>
<li>Flexible Time Off (FTO), 12 company holidays, sick leave and 8-Weeks Paid Parental Leave</li>
<li>Unique professional development benefits with Annual &quot;development dollars&quot; to support our people growth and development</li>
<li>Wellness contests and monthly educational programs</li>
<li>401(K) retirement program</li>
<li>Learn more here: Deepwatch Benefits</li>
</ul>
We know the confidence gap and imposter syndrome can get in the way of meeting spectacular candidates, so please don't hesitate to apply &mdash; we'd love to hear from you. Please review our DEI Statement here.
<div>
Deepwatch welcomes and encourages applications from people with disabilities and accommodations are available on request for candidates taking part in all aspects of the selection process. Please inform your recruiter or contact recruiting@deepwatch.com for further information.</div>
<div></div>
<div>All Deepwatch employees are expected to:</div>
<ul><li>Be interested in and able to work remotely from a home office when not at a corporate office</li>
<li>Pass a pre-employment background check in accordance with applicable laws</li>
</ul>
Deepwatch is an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, disability status, marital status, sexual orientation, gender identity, genetic information, protected veteran status, or any other characteristic protected by law. In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification document form upon hire.

By submitting your application, you agree that Deepwatch may collect your personal data for recruiting, global organization planning, and related purposes. The Deepwatch Privacy Policy explains what personal information we may process, where we may process your personal information, our purposes for processing your personal information, and the rights you can exercise over Deepwatch's use of your personal information.</div></div></div>

General Dynamics Information Technology

<div><div><div>Your Impact
Own your opportunity to serve as a critical component of our nation&rsquo;s safety and security. Make an impact by using your expertise to protect our country from threats.
Job Description<div>
Seize your opportunity to make a personal impact as a Cyber Security Incident Response Analyst supporting customer activities. GDIT is your place to make meaningful contributions to challenging projects and grow a rewarding career.
At GDIT, people are our differentiator. As a Cyber Security Incident Response Analyst, you will help ensure today is safe and tomorrow is smarter. Our work depends on a Cyber Security Incident Response Analyst joining our highly skilled team to be a premier provider of cyber security services to the customer. We have responsibility to ensure operational IT capabilities provide the client with necessary timeliness, accuracy and security of information demanded from all our highly professional roles. Be the change, lead our change &ndash; join us!
HOW A CYBER SECURITY INCIDENT RESPONSE ANALYST WILL MAKE AN IMPACT<ul><li>
Collect intrusion artifacts and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.</li><li>
Coordinate and provide expert technical support to enterprise-wide cyber defense technicians to resolve cyber defense incidents.</li><li>
Coordinate incident response functions within a cloud environment.</li><li>
Monitor external data sources to maintain currency of cyber defense threat conditions and determine which security issues may have an impact on the enterprise.</li><li>
Perform cyber defense trend analysis and reporting.</li><li>
Perform initial, forensically sound collection of images and inspect to discern possible mitigation/remediation on enterprise systems.</li><li>
Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts.</li><li>
Write and publish after-action reviews.</li><li>
Write and publish cyber defense techniques, guidance, and reports on incident findings to appropriate constituencies.</li></ul>
OTHER REQUIREMENTS:<ul><li>
Skill in preserving evidence integrity according to standard operating procedures or national standards.</li><li>
Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions.</li><li>
Knowledge of cyber defense and information security policies, procedures, and regulations.</li><li>
Skill in protecting a network against malware.</li><li>
Knowledge of incident categories, incident responses, and timelines for responses.</li><li>
Knowledge of incident response and handling methodologies.</li><li>
Skill in performing damage assessments.</li><li>
Knowledge of network security architecture concepts including topology, protocols, components, and principles</li><li>
Skill in securing network communications.</li><li>
Skill in using security event correlation tools.</li><li>
Knowledge of network services and protocols interactions that provide network communications.</li><li>
Knowledge of cloud service models and how those models can limit incident response.</li><li>
Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.</li><li>
Knowledge of system administration, network, and operating system hardening techniques.</li><li>
Knowledge of different classes of attacks</li><li>
Knowledge of cyber attackers</li><li>
Knowledge of cyber attack stages</li><li>
Knowledge of malware analysis concepts and methodologies.</li><li>
Skill of identifying, capturing, containing, and reporting malware.</li><li>
Knowledge of system and application security threats and vulnerabilities</li><li>
Knowledge of what constitutes a network attack and a network attack&rsquo;s relationship to both threats and vulnerabilities.</li><li>
Skill in recognizing and categorizing types of vulnerabilities and associated attacks.</li></ul>
WHAT YOU&rsquo;LL NEED TO SUCCEED:<ul><li>
Location: McLean, VA</li><li>
Core Hours: 9:00 am &ndash; 5:00 pm; some flexibility</li><li>
Education: Bachelor's Degree (Computer Engineering, Computer Science, Electrical Engineering, Information Systems, Information Technology, Cybersecurity, or a closely related discipline)</li><li>
Required Experience: 8+ years with a minimum of 3 years experience in Incident Response and/or Computer Forensic Analyst positions</li><li>
Clearance: TS/SCI with Polygraph</li><li>
Certifications: Must meet 8570.01-M baseline certification requirement for Information Assurances Technical (IAT) Level III CASP+CE, CCNP Security, CISA, or CISSP or Associate, GCED, GCIH, or CCSP.</li></ul>
#WeAreGDIT 
#JET 
#VA_2026Alumni
</div></div><div><div><div>Work Requirements</div></div><div></div><div><div>
Years of Experience<div>
8 + years of related experience</div><ul><li>may vary based on technical training, certification(s), or degree</li></ul></div><div></div><div>
Certification</div><div>
Travel Required<div>
Less than 10%</div></div><div></div><div>
Citizenship<div>
U.S. Citizenship Required</div></div></div></div></div><div>
Salary and Benefit Information<div>
The likely salary range for this position is $164,382 - $220,800. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range. 
View information about benefits and our total rewards program.</div>
About Our Work<div>
We are GDIT. A global technology and professional services company that delivers technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across over 50 countries worldwide, offering leading capabilities in digital modernization, AI/ML, cloud, cyber and application development. Together with our customers, we strive to create a safer, smarter world by harnessing the power of deep expertise and advanced technology.</div><div>
Join our Talent Community to stay up to date on our career opportunities and events at gdit.com/tc.</div><div>
Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans</div></div></div>

Cyber Security Incident Response Analyst - TS/SCI w/ Polygraph

Arwen Tech

<div>
 Posted on Apr 16, 2026
 
 
 Title
 
 
 SOC L2 Analyst
 
 
 Apply before
 
 
 May 30, 2026
 
 
 City
 
 
 Karachi
 
 
 
 Responsibilities
 
 
 
 Summary of Job Profile:
 
 
 The SOC L2 Analyst plays a critical role in the proactive defense of the organization's security posture. This individual will leverage their technical expertise and analytical skills to investigate complex security incidents, identify attack patterns, and implement effective countermeasures. The SOC L2 Analyst serves as an escalation point for Tier 1 analysts and contributes to the continuous improvement of SOC processes and security tools.
 
 
 
 Essential Duties &amp; Responsibilities
 
 
 
 <ul>
 <li>
 Monitor security events and alerts generated by various security tools (e.g., SIEM, IDS/IPS, EDR) and escalate complex or high-severity incidents as necessary.
 </li>
 <li>
 Conduct in-depth analysis of security incidents to determine root cause, scope, and impact.
 </li>
 <li>
 Perform threat hunting activities to proactively identify potential security threats that may evade automated detection.
 </li>
 <li>
 Implement containment and remediation strategies for security incidents, including isolating affected systems, blocking malicious traffic, and removing malware.
 </li>
 <li>
 Analyze malware samples and understand their behavior.
 </li>
 <li>
 Develop and refine security incident response procedures and playbooks.
 </li>
 <li>
 Collaborate with Tier 1 analysts, providing guidance and support in incident analysis and handling.
 </li>
 <li>
 Escalate incidents to Tier 3 analysts or other relevant teams (e.g., IR, Engineering) when necessary.
 </li>
 <li>
 Document all incident analysis, containment, and remediation activities in detail.
 </li>
 <li>
 Contribute to the tuning and optimization of security tools and alerting rules.
 </li>
 <li>
 Stay up-to-date on the latest cyber threats, attack techniques, and security vulnerabilities, potentially considering threat trends.
 </li>
 <li>
 Participate in post-incident reviews to identify lessons learned and improve incident response processes.
 </li>
 <li>
 Assist in the development and delivery of security awareness training materials.
 
 
 </li>
 </ul>
 
 Requirements
 
 
 
 Knowledge, Skills, Abilities (KSA&rsquo;s) required to successfully perform the job:
 
 
 
 Knowledge
 
 
 
 <ul>
 <li>
 Strong understanding of TCP/IP and other networking protocols.
 </li>
 <li>
 In-depth knowledge of common cyber threats, attack vectors, and malware types.
 </li>
 <li>
 Familiarity with various security tools and technologies (e.g., SIEM, IDS/IPS, EDR, firewalls, web proxies).
 </li>
 <li>
 Understanding of operating system security (Windows, Linux).
 </li>
 <li>
 Knowledge of security event analysis and correlation techniques.
 </li>
 <li>
 Knowledge of incident response processes and methodologies.
 </li>
 <li>
 Awareness of relevant security regulations and compliance standards.
 </li>
 <li>
 Understanding of threat intelligence sources and their application.
 
 
 </li>
 </ul>
 
 Skills
 
 
 
 <ul>
 <li>
 Proficient in analyzing security logs and identifying malicious activity.
 </li>
 <li>
 Strong understanding of network traffic analysis.
 </li>
 <li>
 Ability to perform basic malware analysis.
 </li>
 <li>
 Skill in using various security tools for incident investigation and response.
 </li>
 <li>
 Good understanding of scripting languages (e.g., Python, PowerShell) for automation.
 </li>
 <li>
 Ability to work effectively under pressure during security incidents
 
 
 </li>
 </ul>
 
 Abilities
 
 
 
 <ul>
 <li>
 Ability to analyze complex security events and identify root causes.
 </li>
 <li>
 Ability to implement effective containment and remediation strategies.
 </li>
 <li>
 Ability to correlate data from various security tools to gain a comprehensive understanding of incidents.
 </li>
 <li>
 Ability to document security incidents clearly and concisely.
 </li>
 <li>
 Ability to learn and adapt to new security threats and technologies.
 </li>
 <li>
 Ability to work independently and as part of a team.
 </li>
 <li>
 Ability to follow established procedures and guidelines
 
 
 </li>
 </ul>
 
 Education, Experience, Licensure, Certification Required For The Position
 
 
 
 <ul>
 <li>
 Bachelor's degree in Computer Science, Information Security, or a related field.
 </li>
 <li>
 3-5 years of experience in a Security Operations Center (SOC) environment, with demonstrable experience in incident analysis and response
 </li>
 <li>
 Relevant security certifications such as CompTIA CySA+, Security+, CEH, or vendor-specific certifications (e.g., Splunk Core Certified User/Power User) are desirable.
 
 
 </li>
 </ul>
 
 Competencies Required To Successfully Perform The Job
 
 
 
 Technical Competencies
 
 
 Behavioral/General Competencies
 
 
 <ul>
 <li>
 SIEM Analysis &amp; Management
 </li>
 <li>
 Basic Malware Analysis
 </li>
 <li>
 Scripting for Automation (e.g., Python, PowerShell)
 </li>
 <li>
 Network Traffic Analysis
 </li>
 <li>
 Endpoint Detection &amp; Response (EDR) Analysis
 </li>
 <li>
 Analytical Thinking
 </li>
 <li>
 Problem Solving
 </li>
 <li>
 Communication (verbal and written)
 </li>
 <li>
 Attention to Detail
 </li>
 <li>
 Responsible
 
 
 </li>
 </ul>
 
 Benefits
 
 
 
 <ul>
 <li>
 Excellent Salary
 </li>
 <li>
 Fuel Allowance
 </li>
 <li>
 Internet Allowance
 </li>
 <li>
 Medical Insurance
 </li>
 <li>
 Annual Leaves
 </li>
 <li>
 Provident Fund
 </li>
 <li>
 EOBI
 </li>
 <li>
 Annual Bonus
 </li>
 </ul>
</div>

SOC L2 Analyst

<div>
 
 Security Operations Analyst (AI Training)
 
 
 
 
 About The Role
 
 
 
 We're partnering with leading AI research labs to build the next generation of security-aware AI systems. As a Security Operations Analyst, your hands-on SOC experience will directly shape how AI understands, reasons through, and responds to real-world cyber threats.
 
 
 This is a unique opportunity to apply your threat detection and incident response expertise beyond the SOC &mdash; and leave a lasting mark on how AI handles security at scale.
 
 
 <ul>
 <li>
 Organization: Alignerr
 </li>
 <li>
 Type: Hourly Contract
 </li>
 <li>
 Location: Remote
 </li>
 <li>
 Commitment: 10&ndash;40 hours/week
 
 
 </li>
 </ul>
 
 What You'll Do
 
 
 
 <ul>
 <li>
 Analyze realistic SOC scenarios &mdash; alerts, incidents, and investigations &mdash; and document how you reason through them
 </li>
 <li>
 Classify severity levels, identify root causes, and recommend appropriate response actions
 </li>
 <li>
 Review and evaluate AI-generated detection logic and investigation workflows for accuracy and realism
 </li>
 <li>
 Validate AI outputs to ensure they reflect how experienced analysts actually think and operate
 </li>
 <li>
 Provide structured, expert feedback that directly improves AI behavior in security contexts
 
 
 </li>
 </ul>
 
 Who You Are
 
 
 
 <ul>
 <li>
 2+ years of experience in SOC, incident response, or security operations
 </li>
 <li>
 Hands-on familiarity with SIEM platforms, alert triage, and investigation workflows
 </li>
 <li>
 Strong ability to distinguish true threats from background noise and false positives
 </li>
 <li>
 Clear written communication skills &mdash; you can explain your reasoning, not just your conclusions
 </li>
 <li>
 Self-motivated and comfortable working independently on task-based assignments
 
 
 </li>
 </ul>
 
 Nice to Have
 
 
 
 <ul>
 <li>
 Experience with threat intelligence, detection engineering, or purple team exercises
 </li>
 <li>
 Familiarity with AI systems or previous AI evaluation work
 </li>
 <li>
 Background in writing detection rules, runbooks, or incident documentation
 
 
 </li>
 </ul>
 
 Why Join Us
 
 
 
 <ul>
 <li>
 Work on frontier AI projects alongside world-class research teams
 </li>
 <li>
 Fully remote and flexible &mdash; work on your own schedule
 </li>
 <li>
 Freelance perks: autonomy, variety, and global collaboration
 </li>
 <li>
 Make a real impact on how AI understands cybersecurity at a foundational level
 </li>
 <li>
 Potential for ongoing work and contract extension
 </li>
 </ul>
</div>

Security Operations Analyst

Hubkom

Summary of Job Profile:The SOC L2 Analyst plays a critical role in the proactive defense of the organization's security posture. This individual will leverage their technical expertise and analytical skills to investigate complex security incidents, identify attack patterns, and implement effective countermeasures. The SOC L2 Analyst serves as an escalation point for Tier 1 analysts and contributes to the continuous improvement of SOC processes and security tools.Essential Duties &amp; Responsibilities<ul><li>Monitor security events and alerts generated by various security tools (e.g., SIEM, IDS/IPS, EDR) and escalate complex or high-severity incidents as necessary.</li><li>Conduct in-depth analysis of security incidents to determine root cause, scope, and impact.</li><li>Perform threat hunting activities to proactively identify potential security threats that may evade automated detection.</li><li>Implement containment and remediation strategies for security incidents, including isolating affected systems, blocking malicious traffic, and removing malware.</li><li>Analyze malware samples and understand their behavior.</li><li>Develop and refine security incident response procedures and playbooks.</li><li>Collaborate with Tier 1 analysts, providing guidance and support in incident analysis and handling.</li><li>Escalate incidents to Tier 3 analysts or other relevant teams (e.g., IR, Engineering) when necessary.</li><li>Document all incident analysis, containment, and remediation activities in detail.</li><li>Contribute to the tuning and optimization of security tools and alerting rules.</li><li>Stay up-to-date on the latest cyber threats, attack techniques, and security vulnerabilities, potentially considering threat trends.</li><li>Participate in post-incident reviews to identify lessons learned and improve incident response processes.</li><li>Assist in the development and delivery of security awareness training materials.</li></ul>RequirementsKnowledge, Skills, Abilities (KSA&rsquo;s) required to successfully perform the job:Knowledge<ul><li>Strong understanding of TCP/IP and other networking protocols.</li><li>In-depth knowledge of common cyber threats, attack vectors, and malware types.</li><li>Familiarity with various security tools and technologies (e.g., SIEM, IDS/IPS, EDR, firewalls, web proxies).</li><li>Understanding of operating system security (Windows, Linux).</li><li>Knowledge of security event analysis and correlation techniques.</li><li>Knowledge of incident response processes and methodologies.</li><li>Awareness of relevant security regulations and compliance standards.</li><li>Understanding of threat intelligence sources and their application.</li></ul>Skills<ul><li>Proficient in analyzing security logs and identifying malicious activity.</li><li>Strong understanding of network traffic analysis.</li><li>Ability to perform basic malware analysis.</li><li>Skill in using various security tools for incident investigation and response.</li><li>Good understanding of scripting languages (e.g., Python, PowerShell) for automation.</li><li>Ability to work effectively under pressure during security incidents</li></ul>Abilities<ul><li>Ability to analyze complex security events and identify root causes.</li><li>Ability to implement effective containment and remediation strategies.</li><li>Ability to correlate data from various security tools to gain a comprehensive understanding of incidents.</li><li>Ability to document security incidents clearly and concisely.</li><li>Ability to learn and adapt to new security threats and technologies.</li><li>Ability to work independently and as part of a team.</li><li>Ability to follow established procedures and guidelines</li></ul>Education, Experience, Licensure, Certification Required For The Position<ul><li>Bachelor's degree in Computer Science, Information Security, or a related field.</li><li>1-3 years of experience in a Security Operations Center (SOC) environment, with demonstrable experience in incident analysis and response</li><li>Relevant security certifications such as CompTIA CySA+, Security+, CEH, or vendor-specific certifications (e.g., Splunk Core Certified User/Power User) are desirable.</li></ul>Competencies Required To Successfully Perform The JobTechnical CompetenciesBehavioural/General Competencies<ul><li>SIEM Analysis &amp; Management</li><li>Basic Malware Analysis</li><li>Scripting for Automation (e.g., Python, PowerShell)</li><li>Network Traffic Analysis</li><li>Endpoint Detection &amp; Response (EDR) Analysis</li><li>Analytical Thinking</li><li>Problem Solving</li><li>Communication (verbal and written)</li><li>Attention to Detail</li><li>Responsible</li></ul>Job Type: Full-timeWork Location: In person

SOC Officer

NexThreat

NexThreat is seeking a Senior Security Operations Analyst (Security Operations Analyst 3) to support contractor-led security operations activities with limited supervision from NIGC federal staff. This role is responsible for performing security monitoring, log analysis, threat awareness, detection/response tuning, continuous monitoring validation, incident response support, and security reporting aligned to established security standards and NIGC goals for protecting sensitive information.Key Responsibilities:The candidate will perform the following activities with minimal supervision and guidance:Security Analysis &amp; Monitoring<ul><li>Perform security analysis activities according to established standards.</li><li>Maintain threat awareness and continuously monitor NIGC information systems for exploits and suspicious activities.</li><li>Analyze aggregated logs and reporting outputs from security tools (including Syslog and SIEM sources).</li><li>Execute security monitoring and analysis tasks in alignment with a daily operational cadence.</li></ul>Daily Reporting Checklist Execution<ul><li>Develop and maintain a daily security analysis and reporting checklist.</li><li>Execute checklist activities daily, ensuring timely detection, triage support, and reporting of security findings.</li></ul>Detection Engineering &amp; Automation Enablement<ul><li>Develop detection and response configuration policies to increase automation and improve alerting and detection quality.</li><li>Support the tuning and validation of detection logic across relevant controls (including EDR, NDR, firewalls, and cloud security tooling).</li></ul>Continuous Monitoring &amp; Threat Hunting<ul><li>Adhere to continuous monitoring practices to evaluate effectiveness of implemented security controls.</li><li>Execute proactive threat hunting activities to ensure confidentiality, integrity, and availability (CIA) of NIGC information systems.</li><li>Evaluate the effectiveness of security analysis activities against best practices and recommend improvements.</li></ul>Incident Handling &amp; Response Support<ul><li>Develop incident handling procedures aligned to NIGC processes and requirements.</li><li>Execute incident response activities and perform associated actions according to the NIGC incident response plan.</li><li>Validate that sufficient and relevant information is captured and retained from security tools to support actionable security awareness and incident investigations.</li></ul>Security Metrics &amp; Threat Reporting<ul><li>Collect security operations performance metrics and NIGC security posture management metrics.</li><li>Prepare NIGC threat reports that inform risk management decisions and support leadership situational awareness.</li></ul>Required Skill Areas / TechnologiesThe Senior Security Operations Analyst will support environments utilizing the following technologies and practices:<ul><li>Cisco Networking</li><li>Cisco Firewall</li><li>Microsoft Cloud Technologies (IaaS, PaaS, SaaS)</li><li>Microsoft Identity Management: Microsoft Entra ID</li><li>Multi-Factor Authentication (MFA)</li><li>Mobile Device Management (iOS)</li><li>Linux Operating System Administration</li><li>Endpoint Detection and Response (EDR)</li><li>Network Detection and Response (NDR)</li><li>Patch Management</li><li>PowerShell</li><li>Log Management (Syslog)</li><li>Security Information and Event Management (SIEM)</li><li>Security Orchestration, Automation, and Response (SOAR)</li><li>Disaster Recovery (DR) support</li></ul>Required Qualifications<ul><li>Senior-level experience performing security operations and security analysis in enterprise environments.</li><li>Demonstrated experience with SIEM and log management (including Syslog), and using aggregated security telemetry for investigation and reporting.</li><li>Demonstrated experience maintaining threat awareness, triaging suspicious activity, and supporting incident response.</li><li>Strong understanding of continuous monitoring practices and proactive threat hunting.</li><li>Experience developing and maintaining detection/response configuration policies and improving alerting quality through automation.</li><li>Experience reporting security posture and operational effectiveness using measurable metrics.</li><li>Working knowledge of Microsoft Entra ID and MFA, endpoint security tooling (EDR), and network security detection tooling (NDR).</li><li>Proficiency with Linux administration and scripting/automation using PowerShell.</li><li>Ability to execute security tasks with limited supervision and consistently follow established standards and operational procedures.</li></ul>Preferred Qualifications<ul><li>Experience supporting environments that integrate Cisco network/security controls with Microsoft cloud security services.</li><li>Experience supporting security orchestration/automation workflows (SOAR) to improve detection and response efficiency.</li><li>Experience validating DR readiness and supporting recovery-related security considerations.</li><li>Relevant cybersecurity certifications (e.g., Security+, CySA+, GIAC, Microsoft Security, or comparable credentials).</li></ul>Pay: $83,164.40 - $100,154.98 per yearBenefits:<ul><li>401(k)</li><li>Dental insurance</li></ul>Work Location: In person

Security Operations Analyst 3, Senior

Search 10000+ Incident response analyst jobs near you this May. New roles added regularly across leading industries. Apply today.

10000 incident response analyst jobs Near Me

Incident Response Analyst

Incident Response Analyst

Cyber Security Incident Response Analyst - TS/SCI w/ Polygraph

SOC L2 Analyst

Security Operations Analyst

SOC Officer

Security Operations Analyst 3, Senior