Who you'll be:

We are seeking a Senior Attack Sensing & Warning Analyst to provide subject-matter expertise for a federal agency's highest-severity security events. You will lead complex event analysis, mentor junior analysts, and serve as a key technical voice in shaping SOC detection strategy. When the SOC faces its toughest calls — ambiguous alerts, novel attack patterns, or fast-moving incidents with executive visibility — you will be the analyst the team looks to for clarity, and your recommendations will directly influence how the SOC tunes its defenses going forward.

What you'll do:

• Lead analysis of the most complex and high-severity security events across SIEM, network, cloud, and endpoint systems.
• Serve as SME for evidence preservation and proper chain-of-custody handling across all data classification levels, up to Top Secret.
• Mentor Tier I and Tier II analysts on advanced triage and analysis techniques.
• Drive security content recommendations (signatures, detection rules) resulting from complex investigations.
• Support the SOC's weekly and monthly reporting cycle with high-fidelity analysis summaries.
• Serve as shift technical lead when the AS&W Lead is unavailable, making real-time escalation and prioritization calls.
• Lead retrospective reviews of significant incidents to identify detection gaps and process improvement opportunities.
• Partner with Cyber Threat Intelligence and Cyber Threat Hunt to validate and operationalize new indicators of compromise.

What you need:

• US Citizenship, 10+ years of experience, BS degree, MS degree.
• A minimum of five (5) years of professional experience in security, information risk management, or information systems risk assessment (Tier 3 specialization).
• Deep knowledge across vulnerability assessment, IPS/IDS, access control, policy enforcement, application security, protocol analysis, firewall management, incident response, DLP, encryption, and advanced threat protection.
• Advanced SIEM query/correlation-rule authoring skills (preferred).
• Experience leading post-incident retrospectives or lessons-learned sessions (preferred).
• Prior informal or formal shift-lead experience in a 24x7 operations environment (preferred).

Required Certifications:

• One or more: CASP+, CISSP, CISA, GCIH, GCED.