Who you'll be:

We are seeking a Senior Attack Sensing & Warning Analyst to provide subject-matter expertise for a federal agency's highest-severity security events. You will lead complex event analysis, mentor junior analysts, and serve as a key technical voice in shaping SOC detection strategy. In times of challenging alerts and fast-moving incidents, you will be the analyst providing clarity, with your recommendations directly influencing SOC defense strategies.

What you'll do:

• Lead analysis of the most complex and high-severity security events across SIEM, network, cloud, and endpoint systems.
• Serve as SME for evidence preservation and proper chain-of-custody handling across all data classification levels, up to Top Secret.
• Mentor Tier I and Tier II analysts on advanced triage and analysis techniques.
• Drive security content recommendations (signatures, detection rules) resulting from complex investigations.
• Support the SOC's weekly and monthly reporting cycle with high-fidelity analysis summaries.
• Serve as shift technical lead when the AS&W Lead is unavailable, making real-time escalation and prioritization calls.
• Lead retrospective reviews of significant incidents to identify detection gaps and process improvement opportunities.
• Partner with Cyber Threat Intelligence and Cyber Threat Hunt to validate and operationalize new indicators of compromise.

What you need:

• US Citizenship
• 10+ years of experience, with a BS or MS degree
• 5 years of professional experience in security, information risk management, or information systems risk assessment (Tier 3 specialization).
• Deep knowledge across vulnerability assessment, IPS/IDS, access control, policy enforcement, application security, protocol analysis, firewall management, incident response, DLP, encryption, and advanced threat protection.

Nice to have:

• Advanced SIEM query/correlation-rule authoring skills.
• Experience leading post-incident retrospectives or lessons-learned sessions.
• Prior informal or formal shift-lead experience in a 24x7 operations environment.

Required Certifications:

• One or more: CASP+, CISSP, CISA, GCIH, GCED