Cyber Defense Analyst – Tier 1

This is a fully remote position, open to applicants in Virginia.

📋 Description

• Oversee customer environments by utilizing security technologies to assess alerts and identify potential threats.

• Generate actionable threat reports and escalate confirmed or suspected threats through the appropriate channels.

• Thoroughly document security investigations within case management tools.

• Implement standard operating procedures for common alert types.

• Conduct basic artifact analyses involving IP addresses, domains, file hashes, URLs, and email headers.

• Carry out initial containment actions, such as isolating hosts and blocking IPs or domains.

• Record actions with timestamps and ensure evidence preservation.

• Handle customer communications and either fulfill or forward requests as needed.

• Assist teammates during assigned shifts.

• Maintain shift turnover reports that cover outstanding work items and situations.

• Verify and enhance customer access, collaborating with Program Managers to achieve full access.

• Transform tribal knowledge into SharePoint articles and shared documentation.

• Revise outdated documentation and keep the knowledge base up to date.

• Review weekly Cyber Threat Reports and open-web information to remain updated on threats.

• Attend or review weekly Threat Intelligence briefings.

• Provide feedback on threat intelligence reports.

• Document and follow up on Program Management requests.

• Communicate with Customer Tech Leads to identify opportunities for alert tuning.

• Engage with Engineering teams regarding system availability and performance issues.

⛳️ Requirements

• 1–2+ years of experience in cybersecurity, IT operations, or security monitoring within a SOC/NOC or a similar environment.

• Hands-on experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage.

• Experience utilizing endpoint detection and response (EDR) tools for basic investigation and containment tasks.

• Practical experience in triaging alerts, performing basic artifact analysis, and escalating incidents.

• Exposure to incident response activities, including initial containment, documentation, and coordination with senior analysts.

• Experience in a 24x7 or shift-based operational environment.

• Experience documenting investigations and maintaining accurate tickets/case records.

• Strong understanding of network protocols and architecture, including TCP/IP, DNS, HTTP/S, VPNs, and common ports/services.

• Proficiency in basic log analysis and event correlation across endpoint, network, identity, and cloud data sources.

• Familiarity with MITRE ATT&CK, Cyber Kill Chain, or major threat frameworks.

• Working knowledge of Windows and Linux operating systems from a security and operations viewpoint.

• Familiarity with at least one major cloud environment: Azure, AWS, or GCP.

• Ability to execute SOPs and runbooks for common alert types and initial containment activities.

• Ability to perform basic artifact analysis, including IP addresses, domains, URLs, file hashes, and simple email header examination.

• Comfort with case management and collaboration tools.

• At least one entry-level cybersecurity certification, such as CompTIA Security+, ISC2 CC, or equivalent.

• Preferred: 2–4+ years of direct SOC, incident response, or security monitoring experience.

• Preferred: Advanced experience with Microsoft Sentinel and/or the Microsoft security stack.

• Preferred: Hands-on experience supporting or leading medium- to high-severity incident responses.

• Preferred: Exposure to cloud security monitoring and hardening techniques.

• Preferred: Experience tuning SIEM/EDR alerts and creating or refining detection use cases.

• Preferred: Familiarity with Python, PowerShell, KQL, or Bash.

• Preferred: Experience in client-facing or consulting environments.

• Preferred: SOC process improvement, documentation, or automation experience.

• Preferred: Intermediate certifications such as CySA+, GSEC, GCIH, CISSP Associate, or equivalent.

🏝️ Benefits

• Medical insurance coverage.

• Vision insurance coverage.

• Dental insurance coverage.

• 401k plan.

• PTO.

• Holidays.

• Additional insurances.