Cyber Operations Center (CyOC) Analyst - Cyber Vulnerability Analyst

Sentar is dedicated to developing the critical talent that the connected world demands to create solutions to address the convergence of cybersecurity, intelligence, analytics, and systems engineering. We invite you to join the small business team where you can build, innovate, and secure your career.

The Cyber Operations Center (CyOC) Analyst plays a critical role in cyber vulnerability analysis, continuous monitoring, and SIEM-based threat detection for the Defense Health Agency (DHA) Cyber Operations Center (CyOC). This role is responsible for identifying, analyzing, and mitigating cybersecurity threats using SIEM platforms, cyber threat intelligence feeds, and vulnerability management tools. The analyst will support DHA’s mission-critical healthcare IT infrastructure by leveraging advanced analytics, real-time monitoring, and risk assessment methodologies to protect the Medical Community of Interest (Med-COI).

As a key member of the CyOC team, the analyst will manage security event data, perform correlation analysis on cyber incidents, track IAVM compliance, and ensure threat intelligence integration across DHA’s cybersecurity ecosystem. This position demands strong SIEM expertise, vulnerability scanning experience, and a proactive approach to cyber defense.

Key Responsibilities

Cybersecurity Monitoring, SIEM Operations & Threat Analysis

• Monitor SIEM dashboards (e.g., Splunk, Elastic, ArcSight) to detect, analyze, and respond to cybersecurity incidents.
• Conduct log correlation, forensic analysis, and anomaly detection using Splunk, HBSS, and centralized logging platforms.
• Develop custom Splunk SIEM queries and detection rules for advanced persistent threats (APTs), insider threats, and unauthorized network activity.
• Perform cyber threat intelligence (CTI) correlation by ingesting USCYBERCOM advisories, OSINT indicators of compromise (IoCs), and SIGACT data into SIEM tools.
• Lead automated alert tuning and SIEM rule refinement to reduce false positives and enhance threat detection accuracy.
• Perform incident correlation analysis, supporting CSSP threat hunt teams and forensic investigations.

Cyber Vulnerability Management & Risk Analysis

• Utilize Assured Compliance Assessment Solution (ACAS) to conduct vulnerability scans, analyze scan results, and track remediation efforts.
• Perform continuous monitoring (ConMon) assessments to identify misconfigurations, compliance deviations, and risk areas.
• Track, analyze, and report on IAVM compliance, POA&Ms, and system risk ratings for DHA networks and Med-COI assets.
• Assess DHA’s cyber exposure, identifying high-risk vulnerabilities and prioritizing remediation efforts based on DoD risk scoring frameworks (CMRS, VRAM, NIST 800-40).
• Develop cyber risk analytics reports, identifying trends, attack surface shifts, and emerging threat vectors.
• Ensure integration of cyber vulnerability data with SIEM dashboards, enabling real-time risk visualization and automated threat prioritization.

Incident Coordination & Response

• Triage and investigate security incidents identified in SIEM platforms, working with incident response (IR) and forensic teams to contain threats.
• Facilitate incident documentation and escalation procedures, ensuring compliance with JFHQ-DoDIN and USCYBERCOM reporting requirements.
• Coordinate remediation actions with affected system owners, ensuring adherence to DoD incident handling and mitigation protocols.
• Support real-time cyber threat response operations, correlating SIEM alerts with vulnerability data and network logs to validate attack scenarios.

Cybersecurity Reporting & Compliance

• Develop and deliver daily, weekly, and monthly cybersecurity risk reports to DHA leadership and interagency partners.
• Track and report cyber compliance metrics, ensuring alignment with DoD directives, DISA CCRI requirements, and JFHQ-DoDIN scoring.
• Maintain and enhance automated SIEM-based compliance dashboards, integrating ConMon, IAVM, and incident management metrics.
• Assist in security control validation and audit preparations, ensuring DHA systems meet DoDI 8530.01, RMF, and NIST 800-53 standards.

Interagency Coordination & Information Management

• Serve as a liaison between CyOC, USCYBERCOM, JFHQ-DoDIN, and VA CSOC to share real-time cyber event data and intelligence.
• Manage the flow and lifecycle of cybersecurity advisories, alerts, and tactical orders, ensuring DHA stakehol