SOC Analyst

This is a 6-month contract position for a SOC Analyst - Tier 3 based in Washington, District of Columbia. The role is a cybersecurity technical resource responsible for providing technical analytical oversight to a team of SOC Analysts. You will monitor, detect, analyze, remediate, and report on cybersecurity events and incidents impacting the technology infrastructure. The ideal candidate will have an advanced technical background with significant experience leading a SOC team or unit responsible for analysis and correlation of cybersecurity event, log, and alert data, and will be skilled in understanding, recognition, and root-cause detection of cybersecurity exploits, vulnerabilities, and intrusions in host and network-based systems.

Responsibilities

• Utilize advanced technical background and experience in information technology and incident response handling to scrutinize and provide corrective analysis to escalated cybersecurity events from Tier 2 analysts, distinguishing these events from benign activities and escalating confirmed incidents to the Incident Response Lead.
• Provide in-depth cybersecurity analysis and trending/correlation of large datasets such as logs, event data, and alerts from diverse network devices and applications within the enterprise to identify and troubleshoot specific cybersecurity incidents and make sound technical recommendations that enable expeditious remediation.
• Proactively search through log, network, and system data to find and identify undetected threats.
• Support security tool and application tuning engagements with analysts and engineers to develop and adjust rules, analyze and develop related response procedures, and reduce false-positives from alerting.
• Identify, verify, and ingest indicators of compromise and attack (IOCs, IOAs) such as malicious IPs and URLs into network security tools and applications.
• Quality-proof technical advisories and assessments prior to release from SOC.
• Coordinate with and provide expert technical support to enterprise-wide technicians and staff to resolve confirmed incidents.
• Report common and repeat problems observed via trend analysis to SOC management and propose process and technical improvements to improve the effectiveness and efficiency of alert notification and incident handling.
• Formulate and coordinate technical best-practice SOPs and Runbooks for SOC Analysts.
• Respond to inbound requests via phone and other electronic means for technical assistance and resolve problems independently. Coordinate escalations with Incident Response Lead and collaborate with internal technology teams to ensure timely resolution of issues.

Qualifications

• Required

• 5+ years hands-on operational experience as a cybersecurity analyst or engineer in a security operations center, or equivalent knowledge.

• 5+ years in-depth understanding of cybersecurity attack countermeasures for adversarial activities such as malicious code, DDoS, and phishing.

• 5+ years in-depth hands-on experience analyzing and responding to security events and incidents with Security Information and Event Management System (SIEM).

• 5+ years strong knowledge of cybersecurity attack methodology to include tactics, techniques, and associated countermeasures.

• 5+ years strong knowledge of TCP/IP protocols, services, networking, and experience identifying, analyzing, containing, and eradicating cybersecurity threats.

• 11-15 years implementing, administering, and operating information security technology such as firewalls, IDS/IPS, SIEM, Antivirus, network traffic analyzers, and malware analysis.

• 11-15 years utilizing advanced experience with scripting and tool automation such as Perl, PowerShell, and Regex.

• 11-15 years developing, leading, and executing information security incident response plans.

• 11-15 years developing standard and complex IT solutions and services, driven by business requirements and industry standards.

• Preferred

• Bachelor's degree in IT, Cybersecurity, Engineering, or equivalent experience.