Mid-Level SOC Analyst (Top Secret Clearance Required)

Paradyme, a CATHEXIS Company is a rapidly growing government technology leader that puts service first, for its customers, its team and the communities it supports. We harness DevSecOps and Agile development processes to deliver exceptional results for digital transformations. Based in Tysons Corner, VA, our award-winning culture sets it apart through its team's deep commitment to service and collaboration with its customers, each other and the community. Learn more at PARADYME

We are seeking SOC Analysts for Junior, Mid, and Senior level openings in support of a critical Law Enforcement customer. The person in this role will support a 24x7x365 Watch Floor team and safeguard the confidentiality, integrity, and availability of an organization's information assets. This position is based at a secured federal facility in Huntsville, AL and requires onsite work.

Active Top-Secret Clearance is required to be considered. Candidates not already in the Huntsville, AL area would have to relocate for ths opportnity.

As a SOC Analyst - Mid Level, this position supports a 24x7x365 SOC. Your duties include analyzing relevant cyber security event data and other data sources for attack indicators and potential security breaches; produce reports, assist in coordination during incidents; and coordinate with the engineering team to ensure all security monitoring systems are on-line, up to date, and fully operational.

Responsibilities:

Monitoring intrusion detection and prevention systems and other security event data sources daily.
• Determining if security events monitored should be escalated to incidents and follow all applicable incident response and reporting processes and procedures.
• Solving problems, asking questions, and discovering why things are happening.
• Correlating data from SIEM / Splunk and Endpoint Detection and Response (EDR) systems with data from other sources such as firewall, web server, and Syslogs.
• Tuning and filtering of events and information, creating custom views and content with the assistance of the Engineering and DevOps team.
• Conducting hunting, monitoring, analyzing, and responding to threats, contribute to Computer Network Defense, and create solutions to augment Defensive Cyber Operations.
• Documenting each incident in the existing ticketing system.
• Coordinating with the DevOps and engineering team to ensure production SOC systems are operational and maintained.
• Reviewing data with the Cyber Threat Intelligence Team, Incident Response Team and other appropriate groups to determine the risk and threat of an event.
• Documenting procedures for handling each security event detected.
• Creating custom queries and develop new use cases to better correlate security event information.
• Identifying misuse, malware, or unauthorized activity on monitored networks and infrastructure.
• Reporting activity appropriately as determined by Management.
• Maintaining proficiency and skills through relevant training, on-the-job training, and self-study.
• Developing and/or maintaining CSIRT Standard Operating Procedures (SOPs) and/or Playbooks, which define repeatable processes for activities such as analysis, reporting, and incident response

Minimum Qualifications:

• Minimum of 5 years of IT experience with at least 2 years as a SOC analyst or other cyber related position.
• Experience with using Splunk SIEM.
• Experience with incident detection and response, security analysis and support for incident response and post incident analysis.
• Strong analytical, attention to detail and problem-solving skills.
• Excels in team environment and collaborating across teams.
• Good interpersonal, organizational, writing, and communications skills.

Preferred Qualifications:

• Bachelor's Degree in Computer Science or related field.
• 1 year experience monitoring cloud environments
• Experience using Microsoft Sentinel.
• Prefer 1 or more of the following certifications:
• GIAC Continuous Monitoring Certification (GMON)
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Network Forensic Analyst (GNFA)
• GIAC Cloud Forensics Responder (GCFR)
• GIAC Cloud Threat Detection (GCTD)

Physical Requirements: These are the essential physical requirements needed to successfully perform the job.

• Sedentary work.
  • Requires sitting up to 8 hours per day.
  • May require lifting up to 5 pounds unassisted.
  • Fine repetitive motor skills with hands, wrists, and fingers in coordination with eyes.
• Hearing, speaking, and vision: Adequate to perform job duties and communicate in person, via video, and telephone. Includes reading information from printed sources and computer screens.
• Other: Work may be performed in an office environment, which may involve frequent contact with staff and the public. Work may be stressful at times.

Paradyme, a CATHEXIS Company is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law. If you are an individual with a disability and would like to request a reasonable accommodation as part of the employment selection process, please contact HR@paradyme.us