Attack Sensing & Warning Analyst

We are seeking a mid-level Attack Sensing & Warning Analyst to strengthen a federal agency's Tier II SOC analysis function. You will perform deeper analysis of triaged events, support SOP development, and help draft executive-level cyber incident reports for the highest-priority incidents. This role is a step up in both technical complexity and ownership: you will regularly work events that Tier I escalates, make judgment calls about severity and next steps, and contribute directly to the SOC's evolving detection content and playbooks.

Responsibilities

Perform Tier II analysis of security events escalated from Tier I monitoring; Support the update of SOC SOPs, ensuring compliance with DHS 4300A and NIST guidance; Create and escalate cybersecurity-related investigations to internal (CIRT, CDF) and external entities; Support triage of Information/Data Spillage Incident Response efforts and handling/sanitization recommendations; Make security content recommendations, including new signatures and signature modifications for SIEM, EDR, and IDS; Contribute analysis and drafting support for executive-level Cyber Incident Reports on significant events; Assist with monitoring tool health and log ingestion to identify any loss or degradation of monitoring coverage; Support ad hoc data calls and enumeration requests, including CISA Binding Operational Directives when relevant to the SOC

Requirements

US Citizenship; 10+ years of related experience; BS degree; MS degree; A minimum of three (3) years of professional experience in cybersecurity, information risk management, or information systems risk assessment (Tier 2 specialization); Knowledge of vulnerability assessment, IPS/IDS, access control, policy enforcement, application security, protocol analysis, incident response, DLP, encryption, and advanced threat protection; Required certifications: one or more of CompTIA CySA+, GICSP, CCNA-Security

Nice to have

Experience tuning SIEM correlation rules or EDR detection policies to reduce false positives; Familiarity with the CCIR (executive incident report) drafting and review process; Prior experience mentoring or training Tier I analysts