Working at the heart of a Department of Defense security operations center at Ft. Meade, a SOC Analyst II serves as a frontline defender responsible for detecting, analyzing, and responding to cyber threats targeting sensitive government networks. Day to day, this analyst monitors enterprise environments through SIEM platforms, conducts log analysis across diverse data sources, and performs network traffic analysis to identify anomalous activity before it becomes a breach. When incidents occur, this person leads or directly supports the full incident response lifecycle — from initial triage through containment, eradication, and after-action reporting. Beyond reactive work, the role demands proactive threat hunting, using threat intelligence and behavioral analytics to surface adversary activity that automated tools miss. Candidates must bring at least four years of hands-on SOC experience and hold an active Top Secret/SCI clearance, which is required from day one — no exceptions. This is a fully onsite position requiring physical presence in a classified environment. The right candidate is technically sharp, operationally disciplined, and comfortable working in a high-stakes, mission-driven setting.
What you'll do
- Monitor SIEM dashboards and alert queues to detect, triage, and prioritize security events across DoD network environments
- Lead and execute incident response actions including containment, eradication, and post-incident documentation for cybersecurity events
- Conduct proactive threat hunting operations using hypothesis-driven methodologies to identify adversary TTPs not caught by automated tools
- Perform deep log analysis across endpoint, network, and application sources to reconstruct attack timelines and determine scope of compromise
- Analyze network packet captures and flow data to characterize malicious traffic patterns and support attribution efforts
- Develop and refine SIEM correlation rules, alerts, and dashboards to improve detection fidelity and reduce false-positive rates
- Produce clear, concise incident reports and briefings for both technical peers and government stakeholders documenting findings and recommended mitigations
Required skills
- SIEM
- incident response
- network analysis
- threat hunting
- log analysis