Cyber Intrusion Analyst

Cyber Intrusion Analyst (SOC) On-Site

Job Description This role supports a large enterprise Department of Defense program by providing real-time cyber intrusion analysis within a high-visibility Security Operations Center. You will detect, investigate, and respond to network security incidents, working closely with Cyber Defense Service Provider (CND-SP/CSSP) teams to protect mission-critical systems and networks. As a technical leader within the team, you will help maintain the integrity and security of enterprise-wide environments, guide the use of monitoring tools, and contribute to the development and tuning of countermeasures against emerging threats.

Responsibilities Work closely with Government counterparts to provide expert guidance within the Computer Network Defense Service Provider (CND-SP) area, ensuring alignment with mission needs and security objectives.

Provide comprehensive CND reporting, including trends, responses, mitigations, analysis, and information dissemination to leadership and mission partners.

Deliver command and control (C2) support and situational awareness for all CND activities across Protect, Detect, Respond, and Sustain functions.

Serve as a technical leader within the Cyber Security Service Provider (CSSP) team, responsible for maintaining the integrity and security of enterprise-wide systems and networks.

Provide technical leadership to CND teams by supporting security initiatives through predictive and reactive analysis and clearly articulating emerging trends and threats to leadership and staff.

Perform computer network incident detection and response activities to detect, correlate, identify, and characterize anomalous activity that may indicate threats to the enterprise.

Monitor various security tools and applications, primarily Splunk and Elastic, for potential malicious activities and investigate associated alerts or indicators.

Develop and recommend courses of action, including mitigation strategies, based on findings from security tools, logs, and network traffic analysis.

Conduct analysis of low-level or "low and slow" events to identify unauthorized activity using exploratory problem-solving and self-learning techniques.

Perform near real-time event triage and analysis, which may result in network traffic validation or the creation of incident reports for mission partners.

Utilize formal monitoring policies and procedures, including DoD-approved network monitoring and traffic analysis tools, to identify suspicious, anomalous, or malicious network traffic on a 24/7/365 basis.

Review and analyze available logs in a timely manner to detect intrusions and notify mission partners of relevant activity through formal reporting processes.

Apply, develop, tune, and distribute or optimize new and existing countermeasures or guidance to prevent or mitigate potential cyber event impacts whenever possible.

Perform detailed network traffic analysis using raw packet data, netflow, IDS, IPS, and custom sensor output to identify and understand security events.

Configure and manage firewalls, IDS/IPS, and other security appliances to support Protect, Defend, Respond, and Sustain activities.

Audit network traffic, harden devices, and implement security policies to enhance the overall security posture.

Use command-line scripting (such as PERL, Python, and Shell) to automate tasks, streamline analysis, and improve operational efficiency.

Support DOD-related projects or programs by providing cyber incident handling expertise and real-time analysis.

Collaborate with other SOC analysts across multiple shifts to ensure continuous monitoring and consistent incident handling coverage.

Essential Skills At least 4 years of overall professional experience, preferably combined with a bachelors degree.

Active Secret clearance, with an active Top Secret clearance preferred.

Minimum of 2 years of Computer Network Defense (CND) analysis experience, including hands-on use of SIEM tools such as Splunk or other SIEM platforms.

Prior experience performing CND duties across Protect, Defend, Respond, and Sustain functions, including configuring firewalls, IDS/IPS, auditing network traffic, hardening devices, and implementing security policies.

Demonstrated experience monitoring IDS and computer defense appliances, specifically using tools such as Splunk and Elastic.

Experience evaluating and interpreting packet captures and network traffic to identify security incidents.

Proficiency with command-line scripting, particularly in PERL,…