Cyber Defense Generalist – Americas Beaverton

Position: Cyber Defense Generalist – Americas Beaverton, OR, US + 1 more
Remote## Cyber Defense Generalist – Americas Beaverton, OR, United States##

Role Description Role located in Beaverton, OR or West Coast Remote The
** Cyber Defense Generalist – Americas
** is a hands-on cyber defense practitioner supporting regional security operations across North and South America. The primary objective of this role is to
** detect, analyze, contain, and support the resolution of business-impacting security threats and events
** through disciplined execution of security operations processes.

This role operates within a
** 24x7 security operations environment**, contributing to incident response, alert triage, threat analysis, threat hunting, and data loss prevention (DLP) investigations under established playbooks and escalation models. The L2 Generalist acts as a reliable second-line responder, handling more complex investigations, supporting incident commanders, and ensuring high-quality evidence, documentation, and communication.

The role provides operational support for
** U.S. Government–regulated and customer-controlled environments**, including
** CMMC-aligned environments**, executing incidents and investigations in a defensible, audit-ready manner consistent with contractual and regulatory requirements.

The Cyber Defense Generalist works in close partnership with global Security Operations, Cyber Defense Engineering, GRC, Audit, IT Shared Services, Infrastructure and Cloud teams, Identity teams, and engages Legal, HR, and Privacy through defined workflows when required. Execution is aligned to the
** Ralliant Business System (RBS)**, emphasizing standard work, repeatability, continuous improvement, and measurable outcomes.##

Key Responsibilities
* Execute SOC operations including alert investigation, correlation, case management, escalation, and shift handoff in alignment with 24x7 operational coverage models.
* Perform incident response activities, including detailed analysis, containment support, evidence collection, and recovery coordination under direction of the incident commander.
* Support incident command by providing timely technical findings, impact assessments, and clear updates suitable for operational and executive audiences.
* Operate, tune and Manage SIEM (Log Scale) for Security operations activities.
* Investigate and respond to DLP alerts, applying defined workflows, documentation standards, and escalation criteria, and coordinating with Legal, HR, and Privacy for sensitive cases.
* Conduct threat analysis and targeted threat hunting, identifying indicators of compromise, validating detections, and surfacing control gaps or improvement opportunities.
* Translate threat intelligence into actionable investigative steps, detection feedback, and response recommendations.
* Support exposure and vulnerability response activities by validating exploitability, assisting with risk-based prioritization, and tracking remediation or exception outcomes.
* Ensure high-quality documentation and evidence handling to support audits, customer inquiries, and regulatory obligations, particularly for regulated environments.
* Contribute to continuous improvement by providing feedback on detections, false positives, playbooks, and operational workflows.
* Participate in simulations, tabletop exercises, and after-action reviews, incorporating lessons learned into day-to-day execution.
1. Follow RBS-aligned standard work, including runbooks, playbooks, checklists, and tooling, to ensure consistent, repeatable, and auditable operations.
* Partner with Cyber Defense Engineering to improve detection coverage and fidelity across endpoint, identity, cloud, SaaS, email, and network telemetry, including tuning to reduce false positives and increase high confidence detections.
* Execute threat hunts focused on both security and resilience, identifying control gaps, validating defensive assumptions, and improving readiness for high impact scenarios.## Qualifications
* Bachelor’s degree recommended; equivalent practical experience considered.
* 3–6+ years of experience in security operations, incident response, or cyber defense roles.
* Demonstrated hands-on experience investigating security…