Cyber Defense Analyst (Tier 1) - Afternoon

Nightwing Technologies, LLC; United States; Remote; USD 85,000 - 120,000; Full time

Job summary

Nightwing Technologies, LLC is seeking a Cyber Defense Analyst to monitor and triage security alerts across VSOC environments, documenting investigations and escalating threats as needed. The role emphasizes timely communication and collaboration with senior analysts to maintain SOC performance.

The position focuses on incident response, SOP execution, basic artifact analysis, and cross-team coordination to ensure continuity of operations and effective threat mitigation in a remote setting.

Responsibilities

• Monitor customer environments to triage security alerts and identify threats.
• Escalate confirmed or suspected threats with actionable reports.
• Document investigations for peer review and collaboration.
• Execute SOPs for common alert types and perform basic artifact analysis.
• Communicate with customers and maintain turnover reports.

Job description

Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers' most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.

Location: Remote

1.0 Role Description

The Cyber Defense Analyst is responsible for monitoring, triaging, and providing first response to security alerts across VSOC customer environments, using various security tools to distinguish meaningful threats from background noise while carefully documenting investigations and analyzing events for signs of true positive threats. They work closely with fellow analysts, sharing findings and leveraging senior colleagues' expertise to deepen their analysis, determine the appropriate severity of each situation, and promptly escalate issues to the right stakeholders. At the end of each shift, they clearly communicate outstanding items and tasks to the incoming team to ensure continuity of operations and effective SOC performance.

Responsibilities

1.1 Primary Responsibilities

• Protect and Defend:
  • Monitor Customer Environments - Leverage the customer's security technologies to triage security alerts and identify potential threats.
  • Escalate confirmed or suspected Threats - Compile an actionable report that describes a threat to the customer environment and escalate through the appropriate channels.
  • Document Investigations - Record security investigation efforts in a thorough manner that allows for easy peer review and collaboration through the appropriate case management tool.
• Incident Response:
  • Execute standard operating procedures (SOPs) for common alert types
  • Perform basic artifact analysis (IP addresses, domains, file hashes)
  • Conduct initial containment actions (isolating hosts, blocking IPs) per runbooks
  • Document all actions taken with timestamps and evidence preservation
• Communicate and Collaborate:
  • Acknowledge and handle Customer Requests - Process communications from assigned customers and fulfill (or forward) the tasks as appropriate.
  • Support your Shift - Be available to your teammates while on shift and ready to assist them at all times.
  • Improve SOC Situational Awareness - Use the Shift Turnover Report to note outstanding work items, tasks and situations that the following shifts should be aware of.

1.2 Secondary Responsibilities

• Maintain SOC Readiness:
  • Verify and Improve Customer Access - Take responsibility of your overall access situation and work with the Program Managers to achieve 100% access across all customers.
  • Identify and Fill knowledge gaps - Convert localized tribal knowledge into global shared knowledge through SharePoint articles and documents for the entire SOC to benefit from.
  • Update outdated documentation - Take stock of currently existing documentation and change the information as necessary to keep the knowledge base current.
• Continuous Development:
  • Keep up-to-date on Threat Landscape - Review Threat Intelligence's weekly Cyber Threat Reports and crawl the open web to learn about contemporary threats to our environments.
  • Hone Blue Team skills - Seek out challenges and trainings to improve your Analysis skillset.
  • Get Creative - Take a proactive approach to problems encountered in your career and consider possible solutions you or the team can implement to overcome them.

2.0 Role Integrations

2.1 Collaboration with the Intelligence Team

Purpose

The Intelligence team provides the Tier 1 Cyber Security Analyst situational updates on the ever-changing Cyber Threat Landscape regularly. T1 Analyst should seek to leverage the knowledge provided to improve their contextual awareness for threats in their daily monitoring duties.

Requirements

• Stay Appraised: Attend weekly Threat Intelligence briefings (or download the recording/slides of the briefings) regularly to stay up-to-date on the latest changes to the Cyber Threat Landscape.
• Feedback Loop: Provide feedback to the intelligence team on the effectiveness and accuracy of the threat intelligence reports received. Share insights and observations from working with the threat hunting content and highlight any areas where additional or more specific information would be beneficial for improving the content's accuracy and relevance.

2.2 Collaboration with the Program Management Team

Purpose

The Program Management team handles the majority of the VSOC's administrative duties for our customer environments. Tier 1 Cyber Security Analysts should leverage the PM team to gain further insight into what their customer environments need from them as well for handling clerical tasks (such as requesting access for customer to