Security Operations Center Analyst

Security Operations Center Analyst

Job Category: Information Technology

Time Type: Full time

Minimum Clearance Required to Start: TS/SCI

Employee Type: Regular

Percentage of Travel Required: None

Type of Travel: None

* * *

Responsibilities include, but are not limited to:

• Provides SOC Security Support managing cyber and network sensor activity
• Performs security event and incident correlation using information gathered from a variety of sources within the enterprise
• Performs cyber incident triage to include determining scope, urgency, and potential impact; identify the specific vulnerability and make recommendations which enable expeditious remediation
• Tracks cyber actions from initial detection through final resolution
• Analyzes and assesses damage to the data / infrastructure
• Performs cyber engineering trend analysis and report

Basic Qualifications:

• Minimum Education: A.S. or equivalent experience in related field.
• Minimum 0-5 years of relevant experience
• CNDSP-IR (GCIH, CSIH, or CEH) certification required
• IAT Level II (GSEC, Security+, SSCP, or CCNA-Security) certification required
• Proficient in Windows and Linux operating systems
• Working knowledge of current COTS Cybersecurity technologies
• Working knowledge of database and operating system security
• Understanding of latest security principles, techniques, and protocols
• Ability to function in a fast-paced environment and effectively manage multiple tasks simultaneously; coordinating resources and ensuring scheduled goals are met
• Excellent verbal and written communication skills are required
• Ability to effectively interact with various levels of senior management is necessary
• Ability to make decisions and resolve problems effectively – seek out information and data to evaluate, prioritize and formulate best solution or practice.
• Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions intrusion detection technologies
• Skill of identifying, capturing, containing, and reporting malware
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race condtions, covert channel, replay, return-oriented attacks, malicious code.)
• Track and document cyber defense incidents from initial detection through final resolution.
• Ability to coordinate with intelligence analysts to correlate threat assessment data.
• Expertise in cloud security, to include Security Incident and Event Management (SIEM); Intrusion Detection and Prevention Systems; ELK (Elasticsearch, Logstash, and Kibana) Stack; Endpoint Protection Systems; Security Orchestration, Automation and Response (SOAR); Firewalls; Log Aggregator; Protocol Analyzers; Vulnerability Assessment Tools
• Knowledge of Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools and applications.
• Knowledge of network monitoring and analysis for system abnormalities, alerts, warnings, and events
• Must be able to multi-task, work independently and as part of a team, share workloads, and deal with sudden shift project priorities
• DoD 8140.03 CSSP Analyst Certification(s), such as GFACT or GISF or Cloud+ or GCED or PenTest+ or Security+ or GSE CCySA+ or CEH or CCE or GCIA or CND.
• Knowledge of disaster recovery continuity of operations plans
• Knowledge of incident categories, incident responses, and timelines for responses

Preferred Qualifications

• Education: B.S. or equivalent experience in related field
• 5 years of relevant experience
• Experience working within a Cybersecurity Operations Center environment desired
• Experience with COTS technologies used in a Cybersecurity Engineering environment desired

-

______________________________________________________________________________

What You Can Expect:

 

A culture of integrity.

At CACI, we place character and innov