Attack Sensing & Warning Analyst Senior

We are seeking a Senior Attack Sensing & Warning Analyst to provide subject-matter expertise for a federal agency's highest-severity security events. You will lead complex event analysis, mentor junior analysts, and serve as a key technical voice in shaping SOC detection strategy. When the SOC faces its toughest calls (ambiguous alerts, novel attack patterns, or fast-moving incidents with executive visibility) you will be the analyst the team looks to for clarity, and your recommendations will directly influence how the SOC tunes its defenses going forward.

Responsibilities

Lead analysis of the most complex and high-severity security events across SIEM, network, cloud, and endpoint systems; Serve as SME for evidence preservation and proper chain-of-custody handling across all data classification levels, up to Top Secret; Mentor Tier I and Tier II analysts on advanced triage and analysis techniques; Drive security content recommendations (signatures, detection rules) resulting from complex investigations; Support the SOC's weekly and monthly reporting cycle with high-fidelity analysis summaries; Serve as shift technical lead when the AS&W Lead is unavailable, making real-time escalation and prioritization calls; Lead retrospective reviews of significant incidents to identify detection gaps and process improvement opportunities; Partner with Cyber Threat Intelligence and Cyber Threat Hunt to validate and operationalize new indicators of compromise

Requirements

US Citizenship; 10+ years of experience; BS degree; MS degree; Minimum of five (5) years of professional experience in security, information risk management, or information systems risk assessment (Tier 3 specialization); Deep knowledge across vulnerability assessment, IPS/IDS, access control, policy enforcement, application security, protocol analysis, firewall management, incident response, DLP, encryption, and advanced threat protection; Required certifications: one or more of CASP+, CISSP, CISA, GCIH, GCED; Work authorization in the US that does not now or in the future require visa sponsorship

Nice to have

Advanced SIEM query/correlation-rule authoring skills; Experience leading post-incident retrospectives or lessons-learned sessions; Prior informal or formal shift-lead experience in a 24x7 operations environment

Benefits

Wide variety of benefits; Opportunities to grow, learn and thrive through hands-on experience, certifications, and industry training