Local Defender - Cybersecurity; SOC Analyst & Threat Analyst

Job Location:

Concord, California

Work Arrangement:
On Site: 100%

Position Type:
Full-Time/Regular

Clearance Required:

Yes

Level of

Clearance Required:

Secret

The Local Defender is a critical cybersecurity role responsible for protecting the organization's digital assets through proactive monitoring, analysis, and response to cyber threats. This role combines the duties of a Security Operations Center (SOC) Analyst and Threat Analyst to ensure an holistic defense against emerging threats. Key responsibilities include monitoring security logs, analyzing and reporting cyber incidents, reviewing Common Vulnerabilities and Exposures (CVEs), and implementing directives from NETCOM (e.g., Cyber Tasking Orders – CTO).

Work is performed on‑site with occasional on‑call duties for critical incidents in a collaborative, demanding environment requiring attention to emerging threats and vulnerabilities.

The preferred candidate will be well‑versed in common cyber threats, vulnerabilities, and adversarial tactics, techniques, and procedures (TTPs). In this role, the candidate is expected to work with minimal guidance, in a cross‑functional team, ensuring reports and recommendations are effectively communicated and actioned to support the Government customer and mission requirements.

• Monitor and analyze security events and alerts generated by SIEM platforms, firewalls, IDS/IPS, and endpoint detection tools to identify potential threats and anomalous behavior.
• Perform basic system administration functions on the sensor capability systems and components, such as applying patches and updates if touch labor is required.
• Analyze data from installed OT sensors to identify patterns and trends and assist with the reports generated regarding system performance and health.
• Diagnose and resolve issues related to sensor data, including malfunctioning sensors, communication problems, and data integrity problems if necessary.
• Analyze potential security incidents and investigate to determine the scope, impact, root cause, and recommend effective remediation strategies.
• Perform triage on security incidents to identify root causes and recommend appropriate mitigation measures.
• Conduct regular reviews of SIEM reports to identify patterns, trends, and potential vulnerabilities within the organization's infrastructure.
• Develop actionable recommendations based on SIEM data analysis to enhance detection capabilities, optimize alert configurations, and address identified gaps.
• Escalate critical incidents to senior leadership or appropriate teams and provide detailed incident summaries with proposed mitigation actions.
• Maintain accurate documentation of security events and incident‑handling procedures.
• Monitor and evaluate Cyber Tasking Orders (CTOs) and other directives from NETCOM, ensuring compliance and timely implementation of mitigations.
• Conduct research on the latest organization's environment threat vectors, attack methodologies, and adversarial tactics, techniques, and procedures (TTPs).
• Collaborate with other cybersecurity team members and the government customer to integrate threat intelligence into incident detection and response processes.
• Analyze CVEs, security bulletins, threat intelligence feeds, and security advisories to assess their relevance and potential impact to the mission and the organization's environment.
• Correlate threat intelligence with SIEM findings to identify and assess emerging threats.
• Develop and communicate proactive mitigation strategies based on threat landscape trends and adversary tactics.
• Generate detailed and actionable reports for leadership from SIEM platforms summarizing identified threats, incidents, and remediation steps.
• Provide…