Cyber Defense Analyst
$101,000–$121,000 year
On-siteClearfield, Utah, United States
Job Summary
Monitor SIEM platforms and analyze system logs to identify security events, anomalies, and indicators of compromise. Investigate alerts to determine validity and scope, then perform incident response triage, investigation, and documentation per established playbooks. Coordinate vulnerability scans, risk assessments, and compliance reviews with the ISSM while maintaining access documentation to enforce least privilege. Track security trends and emerging threats to provide actionable intelligence for improving defensive posture. Collaborate with engineers to tune detection rules and implement controls. Requires four+ years of SOC experience, DoD 8140 certification, and a Secret clearance. Available for evening, weekend, on-call rotation, and up to 25% travel.
Required Qualifications
- Four or more years of hands-on experience in security operations, SOC analysis, incident response, or cybersecurity monitoring, or two years of experience and a degree in a related field
- Certification as required by DoD 8140 for the Cyber Defense Analyst role (e.g. Security+, CEH(P), PenTest+)
- Demonstrated experience with log analysis, security event correlation, and identifying indicators of compromise
- Working knowledge of SIEM platforms and security monitoring tools
- Understanding of common attack vectors, malware behavior, and cyber threat intelligence concepts
- Familiarity with network protocols, TCP/IP fundamentals, and basic network security concepts
- Strong analytical and problem-solving skills with attention to detail
- Excellent written and verbal communication skills for documenting findings and reporting security incidents
- Ability to work scheduled shifts including potential evening, weekend, or on-call rotation coverage
- Must be available to travel up to 25% of the time
- Currently hold or have the ability to obtain United States Secret security clearance
Desired Qualifications
- Bachelor's or higher degree in Cybersecurity, Computer Science, or related technical field
- Additional advanced certifications such as GCIA, CFR, or GICSP
- Four or more years of experience working with DoD organizations or defense contractors in SOC or cyber defense roles
- Deep knowledge of DoD cybersecurity policies, RMF continuous monitoring requirements, and incident response procedures
- Hands-on experience with enterprise logging and monitoring platforms
- Proficiency with threat intelligence platforms and frameworks such as MITRE ATT&CK, STIX/TAXII, or threat feeds
- Experience with network traffic analysis tools and packet analysis
- Familiarity with endpoint detection and response (EDR) tools and host-based forensics
- Understanding of vulnerability management processes and ability to interpret vulnerability scan results
- Scripting or automation skills (Python, PowerShell, Bash) for analysis automation
- Knowledge of the unique security challenges of tactical network operations
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.