Cybersecurity Analyst, Security Operations Center (SOC) Analyst

Cybersecurity Analyst – Tier 1 (Security Operations Center Analyst)

Location: Bethesda, MD (Hybrid; On-site as Required)

Clearance: Tier 2 Public Trust (Required)

Employment Type: Full-Time

Position Summary

Digital Global Connectors (DGC) is seeking a motivated Cybersecurity Analyst – Tier 1 (Security Operations Center Analyst) to support a Federal information security program. The Tier 1 SOC Analyst serves as the first line of defense in monitoring, detecting, analyzing, documenting, and escalating cybersecurity events affecting enterprise information systems and networks.

This position is responsible for continuous monitoring of security tools, initial incident triage, alert validation, event correlation, ticket management, and coordination with higher-tier cybersecurity personnel. The analyst helps identify potential threats, supports incident response activities, and contributes to maintaining a strong enterprise cybersecurity posture through proactive monitoring and timely reporting.

The successful candidate will possess strong analytical skills, experience working within a Security Operations Center (SOC), and a solid understanding of cybersecurity principles, network operations, and security monitoring technologies.

Essential Duties and Responsibilities:

Security Monitoring

Monitor enterprise security monitoring platforms for cybersecurity events and alerts.

Identify, review, and validate potential security incidents.

Analyze security events to determine severity, priority, and potential business impact.

Continuously monitor enterprise networks, systems, endpoints, cloud environments, and applications.

Escalate suspicious activity requiring advanced investigation.

Maintain situational awareness of the organization's security posture.

Event Analysis and Triage

Perform initial analysis of security alerts generated by SIEM, EDR, IDS/IPS, and other security technologies.

Correlate alerts from multiple security platforms.

Distinguish false positives from legitimate security events.

Categorize and prioritize security events based on established procedures.

Document findings and recommended actions.

Initiate incident response procedures when appropriate.

Incident Response Support

Support Tier 2 Incident Responders during security investigations.

Collect preliminary evidence supporting incident analysis.

Preserve relevant logs and security artifacts.

Assist with containment activities under senior analyst guidance.

Update incident records throughout the investigation lifecycle.

Participate in post-incident documentation and lessons learned.

Security Tool Operations

Operate and monitor technologies including:

Microsoft Sentinel

Splunk Enterprise Security

Microsoft Defender XDR

Microsoft Defender for Endpoint

Microsoft Defender for Identity

Microsoft Defender for Cloud

CrowdStrike Falcon

Palo Alto Cortex XDR

Trellix

Cisco Secure

Security Information and Event Management (SIEM)

Endpoint Detection and Response (EDR)

Extended Detection and Response (XDR)

Intrusion Detection and Prevention Systems (IDS/IPS)

Assist in identifying operational issues affecting monitoring platforms and coordinate with engineering teams as needed.

Threat Detection

Monitor indicators of compromise (IOCs) and indicators of attack (IOAs).

Identify suspicious user activity, anomalous network behavior, and unauthorized access attempts.

Recognize malware infections, phishing attempts, credential misuse, and policy violations.

Review threat intelligence provided by internal and external sources.

Support implementation of updated detection rules and monitoring use cases.

Ticket and Case Management

Create, update, and maintain incident tickets.

Document investigation activities, findings, and recommendations.

Track incidents through resolution.

Ensure complete and accurate case documentation.

Escalate unresolved issues according to established procedures.

Maintain audit-ready documentation supporting security operations.

Reporting and Documentation

Develop and maintain:

Incident Reports

Alert Summaries

Daily Operations Reports

Shift Handover Reports

Security Event Logs

Investigation Notes

Trend Reports

Metrics Dashboards

Lessons Learned Documentation

Standard Operating Procedures

Ensure documentation is complete, accurate, and supports operational continuity.

Collaboration

Coordinate with Tier 2 Incident Responders, Threat Hunters, Security Engineers, ISSOs, Vulnerability Management personnel, and technical support teams.

Participate in operational briefings and shift turnover meetings.

Communicate security findings clearly to technical and non-technical stakeholders.

Support cross-functional cybersecurity initiatives.

Maintain effective working relationships across cybersecurity disciplines.

Continuous Improvement

Stay current with emerging cyber threats, attack techniques, and defensive technologies.

Recommend improvements to monitoring procedures and operational workflows.

Participate in tabletop exercises, incident response drills, and training events.

Assist in refining detection logic and operational playbooks.

Pursue professional development and relevant cybersecurity certifications.

Minimum Qualifications

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related discipline.

Minimum two (2) years of experience supporting cybersecurity operations or a Security Operations Center (SOC).

Experience monitoring SIEM, EDR, or related cybersecurity technologies.

Understanding of networking concepts, operating systems, common attack techniques, and cybersecurity fundamentals.

Experience documenting security events and supporting incident investigations.

Strong analytical, organizational, and communication skills.

Ability to work rotating shifts, evenings, weekends, holidays, or on-call schedules as required.

U.S. Citizenship required.

Ability to obtain and maintain a Tier 2 Public Trust.

Preferred Qualifications

Experience supporting a Federal civilian agency.

Experience using Microsoft Sentinel, Splunk Enterprise Security, Microsoft Defender XDR, or comparable enterprise security platforms.

Experience supporting incident response or vulnerability management activities.

Familiarity with the MITRE ATT&CK Framework.

CompTIA Security+

CompTIA CySA+

GIAC Security Essentials (GSEC)

Microsoft Certified: Security Operations Analyst Associate (SC-200)

Splunk Core Certified User or Power User

Cisco CyberOps Associate (preferred)

Knowledge, Skills, and Abilities

Security Operations Center (SOC) Operations

Security Monitoring

Security Information and Event Management (SIEM)

Microsoft Sentinel

Splunk Enterprise Security

Endpoint Detection and Response (EDR)

Extended Detection and Response (XDR)

Microsoft Defender XDR

Microsoft Defender for Endpoint

Microsoft Defender for Cloud

Incident Triage

Event Correlation

Log Analysis

Threat Detection

Malware Identification

Phishing Analysis

Network Security

TCP/IP

Windows Security

Linux Security

MITRE ATT&CK Framework

NIST Cybersecurity Framework

NIST Risk Management Framework (RMF)

Ticket Management

Technical Documentation

Microsoft Office Suite

ServiceNow

Jira

Security Requirements

Ability to successfully obtain and maintain a Tier 2 Public Trust investigation.

Compliance with all applicable Federal security, privacy, ethics, and information assurance training requirements before receiving system access.

Ability to support 24x7 cybersecurity operations, emergency response activities, scheduled maintenance windows, continuity of operations (COOP), and surge support as required.

Must maintain strict confidentiality while handling sensitive security events, log data, investigation records, and Federal information systems.

Ability to work effectively in a fast-paced Security Operations Center environment while providing timely monitoring, accurate incident documentation, and responsive support to Government stakeholders and cybersecurity teams.