About this role

Job Responsiblities

Job Responsibilities

- Advanced Security Monitoring & Incident Response: Provide Tier III SOC support for security alert triage, complex incident investigations, forensic analysis, and escalation of advanced security threats across federal enterprise environments.

- Threat Detection & Analysis: Analyze security events, SIEM alerts, endpoint telemetry, network traffic, and threat intelligence to identify malicious activity, determine potential impact, and recommend appropriate containment and remediation actions.

- SOC Tools & Situational Awareness: Maintain comprehensive operational awareness of SOC security technologies, monitoring platforms, log sources, and telemetry to ensure continuous visibility into enterprise security posture and emerging threats.

- Incident Investigation & Escalation: Lead advanced technical investigations, correlate security events across multiple data sources, perform root cause analysis, and coordinate incident escalation and response activities with cybersecurity stakeholders.

- SOC Operations & Process Improvement: Lead shift handovers, maintain incident documentation, and develop, review, and update Standard Operating Procedures (SOPs), incident response playbooks, and operational workflows to improve SOC efficiency and consistency.

- Red Team & Purple Team Collaboration: Support Red Team and Purple Team exercises by evaluating detection capabilities, analyzing simulated attack activity, identifying monitoring gaps, and recommending improvements to threat detection and response procedures.

- Technical Leadership & Knowledge Sharing: Provide technical guidance and mentorship to junior SOC analysts, assist with complex troubleshooting, and contribute to continuous improvements in threat detection, incident handling, and SOC operational effectiveness.

Job Requirements

- Security Operations Experience: Minimum of 6 years of progressive experience in Security Operations Center (SOC) operations, cybersecurity monitoring, threat detection, incident response, or related security disciplines, including advanced incident investigation and escalation responsibilities.

- Professional Certifications: Must possess at least one of the following certifications: GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), Certified Ethical Hacker (CEH), or CompTIA Security+.

- SIEM & Endpoint Security Expertise: Demonstrated hands-on experience with SIEM platforms, security event correlation, endpoint detection and response (EDR) technologies, endpoint telemetry analysis, and advanced security alert investigation within enterprise environments.

- Operating Systems, Networking & Cloud Security: Strong technical knowledge of Windows and Linux operating systems, network protocols, enterprise networking, and AWS-native security capabilities, including experience investigating security events across on-premises and cloud environments.

- Incident Response & Technical Communication: Proven ability to conduct complex security investigations, analyze potential indicators of compromise (IOCs), document technical findings, execute incident escalation procedures, and communicate actionable security recommendations to technical teams and federal stakeholders.