Cybersecurity Ops Analyst
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Cybersecurity Ops Analyst monitoring and investigating threats for SAIC, a defense and mission technology integrator. Operating SIEM and EDR tools across a 24/7/365 security operations center.
Responsibilities:
- Perform advanced security event analysis as part of the 24/7/365 Enterprise Security Operations Center Detection & Response team
- Monitor, triage, and investigate security alerts and anomalous activity
- Determine severity, scope, potential impact, and appropriate response actions
- Analyze and correlate network, endpoint, system, and cloud telemetry using SIEM and EDR technologies
- Evaluate suspicious activity, threat intelligence, and vulnerability information to identify potential threats and assess organizational risk
- Execute approved response actions, including IP, URL, and hash blocks and endpoint isolation
- Escalate confirmed or suspected incidents to appropriate incident response teams
- Participate in proactive threat hunting to identify suspicious behavior, indicators of compromise, and detection gaps
- Document investigations, findings, evidence, and response actions in the incident tracking system
- Recommend detection tuning, process enhancements, and procedure and documentation updates
- Support onboarding and training of new analysts through knowledge sharing, cross-training, and technical assistance
- Collaborate with cybersecurity teams including GRC, architecture, and detection engineering
Requirements:
- Bachelor’s degree and 2+ years of experience, or an Associate’s degree in a related discipline and 3+ years of experience
- An additional 4+ years of experience may be considered in lieu of a degree
- Must be a US Citizen
- Minimum 2 years of cybersecurity operations related experience
- Security+ and CySA+ certifications required
- Hands-on experience with SIEM and EDR technologies, including security alert investigation, endpoint analysis, and correlation of security events
- Experience triaging security incidents, assessing severity and potential impact, and determining escalation procedures
- Working knowledge of network security fundamentals and identification of suspicious network activity
- Working knowledge of Windows, Linux, and cloud environments, including relevant security logs, events, and telemetry
- Understanding of attacker tactics, techniques, and procedures, including the MITRE ATT&CK framework
- Ability to independently investigate complex or unfamiliar security events and exercise sound technical judgment
- Strong written and verbal communication skills, including clear documentation and coordination with technical and nontechnical stakeholders
- Ability to share technical knowledge and guide less experienced analysts
- Preferred: hands-on experience with Splunk Enterprise Security
- Preferred: experience with full incident response lifecycles, including containment, eradication, recovery, and post-incident analysis
- Preferred: proactive threat hunting and detection tuning experience
- Preferred: familiarity with Python, PowerShell, or similar scripting and automation technologies
Benefits:
- Remote work anywhere in the United States
- 2nd shift or 3rd shift schedule option
- Equal Opportunity Employer
Similar Jobs
Cybersecurity Operations Supervisor, 3rd Shift
Cybersecurity Operations Supervisor leading SAIC’s 24/7 enterprise security response team. Managing investigations, analysts, staffing, and continuous SOC improvements on third shift.
Security Architect
Security Architect designing and assuring secure systems for NEC Software Solutions. Supporting critical public-sector services through threat modelling, governance, and security architecture.
Senior Counsel – Data Governance, Privacy, Cybersecurity
Senior Counsel guiding Cencora’s healthcare services organization on data privacy, cybersecurity, AI, and governance. Advising on regulated health data, contracts, incident response, and technology-enabled offerings.
Adjunct Faculty, Cybersecurity for Leaders and Managers
Cybersecurity adjunct faculty teaching CSIA 300 asynchronously for University of Maryland Global Campus. Mentoring adult learners and supporting their academic and professional growth.
Adjunct Faculty – Microsoft 365 Endpoint Administration, Cybersecurity
Adjunct faculty teaching Microsoft 365 Endpoint Administration at UMGC, an online university serving nontraditional learners. Mentoring students through asynchronous, hands-on cybersecurity coursework.
Security Advisor II, Falcon Complete
Security Advisor guiding CrowdStrike Falcon Complete customers toward stronger security postures. Assessing Falcon environments, recommending remediation, and resolving customer issues.
Senior Director – Security Posture & Exposure Management
Senior security leader overseeing Lilly’s enterprise vulnerability management and exposure reduction. Leading teams, tooling, prioritization, remediation, and executive risk reporting for a global medicines company.
Infrastructure Security Vulnerability Engineer
Infrastructure Security Vulnerability Engineer reducing vulnerability risk across Avaya’s FedRAMP cloud environments. Coordinating remediation, compliance, reporting, and security improvements for federal-government operations.
Cybersecurity Specialist
Cybersecurity Specialist monitoring alerts and investigating incidents for CyberMaxx’s managed detection and response cybersecurity services. Supporting threat detection, customer response, and SOC operations.
Senior Information Security Engineer
Information Security Engineer monitoring threats and vulnerabilities for First American's title insurance, settlement, and property technology solutions. Operating security tools, incident response, risk analysis, and recovery processes.
Senior Information Security Engineer
Senior Cloud Security Engineer operating CNAPP platforms and securing cloud environments at First American India. Driving cloud risk remediation across infrastructure, applications, Kubernetes, and DevSecOps teams.
Senior Security Consultant
Senior Security Consultant designing low-voltage and communication systems for ARES data center infrastructure projects. Coordinating BIM, documentation, budgets, and project stakeholders.
Red Team Security Engineer
Red Team Security Engineer validating vulnerabilities, attack paths, and AI-enabled systems. Strengthening defenses for Backblaze’s open cloud storage platform through offensive and purple-team exercises.
Online Visiting Professor – Cybersecurity
Online Visiting Professor teaching undergraduate and graduate cybersecurity courses for DeVry University. Developing course materials, assessing students, and integrating responsible AI into instruction.
Information Security Specialist
Information Security Specialist protecting Farmers’ global insurance systems and data from cybersecurity risks. Assessing vulnerabilities, managing incidents, strengthening controls, and advising technology teams.
Strategic Solution Sales Executive – Cybersecurity
Strategic cybersecurity sales executive driving OpenText solution growth across U.S. enterprise accounts. Leading complex solution sales cycles and executive stakeholder engagements.
Security Cooperation Financial Management Specialist – Lead
Financial management specialist supporting U.S. Combatant Commands with DAI accounting, audit readiness, and process improvement. Remote role for Koniag Government Services’ federal defense operations.
Manager, Application Security – SOX IT, Oracle Fusion
Application Security Manager securing Oracle Fusion, EPM, and OIC environments for Paramount’s global media and entertainment company. Leading SOX compliance, identity governance, and segregation-of-duties controls.
Senior Security Engineer, Threat Detection and Response
Senior Security Engineer investigating threats, building detection automation, and improving incident response. Supporting U.S.-based corporate and production environments through security engineering and threat hunting.
Staff Security Engineer, Security Enablement
Staff Security Engineer designing DoorDash’s global physical and cloud security systems. Leading multi-team programs, AWS infrastructure, security integrations, and enterprise risk reduction.