Who you'll be:

We are seeking a mid-level Attack Sensing & Warning Analyst to strengthen a federal agency's Tier II SOC analysis function. You will perform deeper analysis of triaged events, support SOP development, and help draft executive-level cyber incident reports for the highest-priority incidents. This role is a step up in both technical complexity and ownership — you will regularly work events that Tier I escalates, make judgment calls about severity and next steps, and contribute directly to the SOC's evolving detection content and playbooks.

What you'll do:

• Perform Tier II analysis of security events escalated from Tier I monitoring.
• Support the update of SOC SOPs, ensuring compliance with DHS 4300A and NIST guidance.
• Create and escalate cybersecurity-related investigations to internal (CIRT, CDF) and external entities.
• Support triage of Information/Data Spillage Incident Response efforts and handling/sanitization recommendations.
• Make security content recommendations, including new signatures and signature modifications for SIEM, EDR, and IDS.
• Contribute analysis and drafting support for executive-level Cyber Incident Reports on significant events.
• Assist with monitoring tool health and log ingestion to identify any loss or degradation of monitoring coverage.
• Support ad hoc data calls and enumeration requests, including CISA Binding Operational Directives when relevant to the SOC.

What you need:

• US Citizenship;
• 10+ years of related experience; BS degree; MS degree
• A minimum of three (3) years of professional experience ssional experience in cybersecurity, information risk management, or information systems risk assessment (Tier 2 specialization).
• Knowledge of vulnerability assessment, IPS/IDS, access control, policy enforcement, application security, protocol analysis, incident response, DLP, encryption, and advanced threat protection.

Nice to have:

• Experience tuning SIEM correlation rules or EDR detection policies to reduce false positives.
• Familiarity with the CCIR (executive incident report) drafting and review process.
• Prior experience mentoring or training Tier I analysts.

Required Certifications:

• One or more: CompTIA CySA+, GICSP, CCNA-Security