Cyber Defense Analyst II

Job description

Job responsibilities

• Monitor and triage. Work security events and alerts across SIEM, EDR, network sensors, and audit logs. Determine what's noise, what's misconfiguration, and what warrants escalation.
• Investigate. Pull the threads — pivot across host, network, and identity data to build a picture of what actually happened, and document it clearly.
• Respond. Serve as first responder during incidents. Execute containment steps per playbook, preserve evidence, build timelines, and support senior engineers leading the response.
• Hunt. Participate in structured hunts, initially alongside senior team members and increasingly on your own hypotheses as you learn what "normal" looks like here.
• Support audit and insider threat review. Perform privileged user activity monitoring and audit log review in partnership with Security and Counterintelligence.
• Stand watch during mission events. Provide heightened monitoring coverage during launches, mission operations, and other critical windows.
• Get hands on the tooling. Assist with sensor deployment, log source onboarding, and agent rollout across enclaves under engineering direction.
• Tune and improve detections. Reduce false positives, validate rule coverage, and propose new detections based on what you find in the data.

Job requirements

• 2+ years of hands-on experience in security operations, incident response, IT operations, or system administration or equivalent military/government cyber experience
• Working knowledge of network protocols and Windows and Linux fundamentals
• Familiarity with SIEM and EDR concepts and the ability to investigate events using them
• Understanding of common attack techniques and exposure to the MITRE ATT&CK framework
• Clear, concise written communication — your investigation notes will be read by senior staff and government customers
• Genuine curiosity and the instinct to keep pulling on a thread when something doesn't add up
• Active U.S. Government Top Secret clearance with SCI eligibility and eligibility for SAP access determination; U.S. citizenship
• DoD 8140 CSSP Analyst or IAT Level II certification (Security+ CE or equivalent) at hire or within [6] months