Security Operations Center Analyst - High

Security Operations Center Analyst
- High

Washington, DC, USA

Posted Wednesday, July 15, 2026 at 4:00 AM

Koniag Data Solutions, LLC, a Koniag Government Services company, is seeking a Security Operations Center Analyst
- High to support KDS and our government customer in Washington, DC. This position requires the candidate to be able to obtain a Public Trust.

We offer competitive compensation and an extraordinary benefits package including health, dental and vision insurance, 401K with company matching, flexible spending accounts, paid holidays, three weeks paid time off, and more.

Koniag Data Solutions, a Koniag Government Services company, is seeking a highly skilled and experienced Senior Security Operations Center (SOC) Analyst to support the U.S. Small Business Administration (SBA). The ideal candidate is a seasoned cybersecurity professional with extensive experience in advanced security operations, threat detection, and incident response within complex federal government IT environments. This individual will serve as a senior technical resource within SBA's SOC, providing expert-level analysis, mentorship to junior analysts, and close collaboration with the Cybersecurity Operations Technical Lead to protect SBA's enterprise IT environment from sophisticated and evolving cyber threats.

The Senior SOC Analyst will serve as an advanced-level cybersecurity operations professional within SBA's Security Operations Center, providing expert threat detection, in-depth security event analysis, and incident response leadership while mentoring junior and mid-level SOC staff and driving continuous improvement of SOC capabilities and processes.

• Perform advanced, continuous monitoring and analysis of security alerts and events generated by SBA's SIEM platform, IDS/IPS systems, endpoint detection and response (EDR) tools, and other security monitoring technologies, applying expert-level analytical skills to accurately detect, classify, and prioritize security incidents and threats targeting SBA's enterprise environment.
• Lead and conduct in-depth investigation and analysis of complex security incidents, applying advanced knowledge of threat actor TTPs, attack methodologies, and the MITRE ATT&CK framework to determine incident scope, root cause, and full impact, and driving incident response activities through to successful resolution.
• Serve as a senior escalation point for security incidents and complex alerts escalated by junior and mid-level SOC analysts, providing expert technical guidance, mentorship, and decision support to ensure timely and effective incident triage, escalation, and response.
• Lead and support incident response activities for significant security incidents affecting SBA's enterprise environment, coordinating containment, eradication, recovery, and post-incident review activities in accordance with SBA's incident response policies and NIST SP 800-61 guidelines, and communicating incident status and findings to the Cybersecurity Operations Technical Lead and SBA leadership.
• Conduct advanced log analysis and correlation across diverse data sources, including Windows Event Logs, Syslog, cloud platform logs, firewall logs, web proxy logs, EDR telemetry, and application logs, to reconstruct attack timelines, identify malicious activity patterns, and develop actionable intelligence to support incident response and detection improvement activities.
• Develop, tune, and optimize SIEM detection rules, correlation logic, alert thresholds, and dashboards to improve the accuracy and effectiveness of SBA's threat detection capabilities, reduce false positive rates, and enhance SOC analyst efficiency
• Perform advanced threat hunting activities, proactively searching SBA's enterprise environment for hidden threats, indicators of compromise (IOCs), and adversary TTPs using the MITRE ATT&CK framework, threat intelligence feeds, and advanced analytical techniques to identify malicious activity that has evaded automated detection.
• Analyze and operationalize threat intelligence from government and commercial sources, including US-CERT, CISA, ISACs, and commercial threat intelligence platforms, to identify relevant threats, update detection capabilities, and prioritize SOC monitoring and response activities based on current threat landscape intelligence.
• Develop high-quality incident reports, after-action reviews (AARs), threat analysis reports, and technical documentation capturing incident timelines, root cause analysis, findings, and actionable remediation recommendations, tailored to both technical and non-technical SBA audiences.
• Support and contribute to vulnerability management activities, providing expert analysis of vulnerability scan results, assessing real-world exploitability and risk, and advising on remediation prioritization strategies to support timely and effective vulnerability remediation across SBA's system portfolio.
• Develop, review, and…