SOC Analyst (5333)

Essential Duties & Responsibilities

• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities
• Implement and manage multiple security tools to include SIEM's, firewalls, IDS/IPS's, threat and vulnerability management tools, data loss prevention tools, filtering technologies, traffic inspection solutions, reporting technology and data analytics platforms
• Use cyber defense tools for continual monitoring and analysis of system to identify malicious activity
• Document and escalate incidents (including event's history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment
• Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information
• Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack
• Conduct research, analysis, and correlation across a wide variety of all source data sets (indications and warnings)
• Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts
• Perform cyber defense trend analysis and reporting
• Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources
• Coordinate with enterprise-wide cyber defense staff to validate network alerts. Identify and analyze anomalies in network traffic using metadata
• Provide daily summary reports of network events and activity relevant to cyber defense practices. Identify applications and operating systems of a network device based on network traffic
• Threat research, OSINT, and classified sources for TTPS, IOCs and signatures for monitoring and alerting. RMF/CONMON support to aid in the mitigation of findings
• Supporting engineering to ensure network designs and operations are secure from inception to production

Required Skills/Experience

• Clearance Required: Top Secret
• 3-5 years of applicable work experience
• CompTIA Network+ certification
• Operating System certifications
• One or more of the following industry certifications: GCIA, GCIH, GCDA, GSOC, GCED, CYSA or equivalent certs
• Must be able to maintain DoD-8140 compliance

Desired Qualifications:

• Linux OS experience