Cybersecurity Analyst

1-3 years in a SOC, cybersecurity 'blue team', or closely related role. Strong grasp of TCP/IP, OSI model, and common protocols (HTTP, DNS, SMTP). Windows/Linux/macOS fundamentals. Active Directory/Azure AD concepts. Basic cloud logging. Experience with at least one SIEM and one EDR/XDR platform. Experience with ticketing/case management. Ability to craft queries using common languages; comfort with regex, JSON and APIs. Basic scripting in Python/PowerShell/Bash. Excellent analytical, problem-solving, and communication skills. Ability to operate under pressure in a shift or on-call environment. Experience in system and network administration. Ability to work collaboratively. Considerable knowledge/experience of assessing security controls. Experience and skill in conducting audits or reviews of technical systems. Experience working in a government environment. Experience working in a distributed IT environment. Ability to qualify for HSPD-12 card. Able to work both independently and as a contributing member of a small technical team. Able to disseminate knowledge to current staff.

Continuously monitor, triage alerts and tickets, and investigate suspicious activity or poor configurations. Orchestrate responses to protect systems and data. Reset user and service account passwords. Ensure authorizers are designated for in-scope accounts. Analyze account usage patterns. Review new access or account approval requests. Triage unusual access requests and phishing reports. Evaluate endpoint and detection response (EDR) installation and coverage. Identify systems without EDR and provide remediation information. Monitor external attack surface for unapproved systems, undocumented systems, and new vulnerabilities. Review systems with public access to ensure compliance with requirements. Attend online/Teams meetings. Collaborate with the team on task status, improvements, and implementation.