Cyber Defense Analyst, Tier 1 – Overnight

This is a fully remote position, open to applicants in Virginia.

📋 Description

• Oversee customer environments and assess security alerts to pinpoint potential threats.

• Elevate confirmed or suspected threats via appropriate channels with actionable documentation.

• Meticulously document security investigations within the case management tool.

• Implement standard operating procedures for common alert types.

• Conduct basic analysis of artifacts, including IP addresses, domains, file hashes, URLs, and simple email headers.

• Execute initial containment measures such as isolating hosts and blocking IPs/domains according to runbooks.

• Record all actions with timestamps and preserve evidence.

• Address customer requests and fulfill or redirect tasks as needed.

• Assist teammates during shifts.

• Utilize Shift Turnover Reports to relay outstanding tasks and situations to the following shifts.

• Verify and enhance customer access, collaborating with Program Managers to achieve full access across customers.

• Transform localized knowledge into shared SOC knowledge by creating SharePoint articles and documents.

• Update outdated documentation and sustain the knowledge base.

• Examine weekly Cyber Threat Reports and monitor the open web for emerging threats.

• Engage in training and challenges to enhance blue-team analysis capabilities.

• Attend or review weekly Threat Intelligence briefings and provide insights on intelligence reports.

• Document and follow up on Program Management requests within the case management system.

• Communicate with Customer Technology Leads regarding environmental issues and alert-tuning possibilities.

• Liaise with Engineering about matters affecting system availability or performance.

⛳️ Requirements

• 1–2+ years of experience in cybersecurity, IT operations, or security monitoring within a SOC/NOC or similar environment.

• Practical experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage.

• Experience utilizing endpoint detection and response (EDR) tools for basic investigation and containment tasks.

• Hands-on experience in triaging alerts, conducting basic artifact analysis, and escalating incidents.

• Familiarity with incident response activities (initial containment, documentation, coordination with senior analysts).

• Experience in a 24x7 or shift-based operational environment.

• Proficient in documenting investigations and maintaining accurate tickets/case records.

• Strong understanding of network protocols and architecture (TCP/IP, DNS, HTTP/S, VPNs, common ports/services).

• Skilled in basic log analysis and event correlation across multiple data sources (endpoint, network, identity, cloud).

• Knowledge of major threat frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain) and their practical applications.

• Working familiarity with Windows and Linux operating systems from both security and operations perspectives.

• Acquainted with at least one major cloud environment (Azure, AWS, or GCP) and its fundamental security concepts.

• Ability to execute SOPs and runbooks for common alert types and initial containment actions (host isolation, blocking IPs/domains).

• Capable of performing basic artifact analysis (IP addresses, domains, URLs, file hashes, simple email header review).

• Comfortable using case management and collaboration tools to track and share investigation details.

• At least one entry-level cybersecurity certification (e.g., CompTIA Security+, ISC2 CC, or equivalent).

• Preferred: 2–4+ years of direct SOC, incident response, or security monitoring experience.

• Preferred: Advanced experience with Microsoft Sentinel and/or Microsoft security stack (Defender, M365, Entra ID).

• Preferred: Hands-on experience supporting or leading incident response for medium to high-severity events.

• Preferred: Exposure to cloud security monitoring and hardening (Azure, AWS, or GCP).

• Preferred: Experience tuning SIEM/EDR alerts and creating or refining detection use cases.

• Preferred: Familiarity with scripting or automation (Python, PowerShell, KQL, Bash) to aid investigations.

• Preferred: Experience in client-facing or consulting roles.

• Preferred: Previous involvement in SOC process enhancements, documentation, or automation projects.

• Preferred: One or more intermediate certifications (e.g., CySA+, GSEC, GCIH, CISSP Associate, or equivalent).

🏝️ Benefits

• Medical insurance coverage.

• Vision insurance coverage.

• Dental insurance coverage.

• 401k plan.

• PTO.

• Holidays.

• Additional insurances.