Cyber Defense Analyst (Tier 1) - Overnight

Nightwing Technologies, LLC; United States; À distance; USD 90 000 - 120 000; Plein temps

Résumé du poste

Nightwing Technologies, LLC is seeking a Cyber Defense Analyst to monitor, triage, and respond to security alerts across VSOC customer environments. The role emphasizes documenting investigations, escalating threats, and coordinating with colleagues to ensure timely incident response.

This remote position supports 24/7 SOC operations and collaboration with the Intelligence and PM teams. The candidate will follow SOPs, perform basic artifact analysis, contain incidents per runbooks, and maintain

Qualifications

• Monitor security alerts and triage potential threats across customer environments.
• Document investigations with timestamps and evidence for peer review.

Responsabilités

• Monitor Customer Environments and triage alerts.
• Escalate confirmed or suspected threats with actionable reports.
• Document investigations with timestamps and evidence preservation.
• Execute standard operating procedures for common alert types.
• Perform basic artifact analysis (IPs, domains, file hashes).
• Conduct initial containment actions per runbooks.
• Document all actions taken with timestamps.

Description du poste

Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers' most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.

Location: Remote

1.0 Role Description

The Cyber Defense Analyst is responsible for monitoring, triaging, and providing first response to security alerts across VSOC customer environments, using various security tools to distinguish meaningful threats from background noise while carefully documenting investigations and analyzing events for signs of true positive threats. They work closely with fellow analysts, sharing findings and leveraging senior colleagues' expertise to deepen their analysis, determine the appropriate severity of each situation, and promptly escalation issues to the right stakeholders. At the end of each shift, they clearly communicate outstanding items and tasks to the incoming team to ensure continuity of operations and effective SOC performance.

Responsibilities

1.1 Primary Responsibilities

Protect and Defend:

• Monitor Customer Environments - Leverage the customer's security technologies to triage security alerts and identify potential threats.
• Escalate confirmed or suspected Threats - Compile an actionable report that describes a threat to the customer environment and escalated through the appropriate channels.
• Document Investigations - Record security investigation efforts in a thorough manner that allows for easy peer review and collaboration through the appropriate case management tool.

Incident Response:

• Execute standard operating procedures (SOPs) for common alert types
• Perform basic artifact analysis (IP addresses, domains, file hashes)
• Conduct initial containment actions (isolating hosts, blocking IPs) per runbooks
• Document all actions taken with timestamps and evidence preservation

Communicate and Collaborate:

• Acknowledge and handle Customer Requests – Process communications from assigned customers and fulfill (or forward) the tasks as appropriate.
• Support your Shift - Be available to your teammates while on shift and ready to assist them at all times.
• Improve SOC Situational Awareness - Use the Shift Turnover Report to note outstanding work items, tasks and situations that the following shifts should be aware of.

1.2 Secondary Responsibilities

Maintain SOC Readiness:

• Verify and Improve Customer Access - Take responsibility of your overall access situation and work with the Program Managers to achieve 100% access across all customers.
• Identify and Fill knowledge gaps - Convert localized tribal knowledge into global shared knowledge through SharePoint articles and documents for the entire SOC to benefit from.
• Update outdated documentation - Take stock of currently existing documentation and change the information as necessary to keep the knowledge base current.

Continuous Development:

• Keep up-to-date on Threat Landscape - Review Threat Intelligence's weekly Cyber Threat Reports and crawl the open web to learn about contemporary threats to our environments.
• Hone Blue Team skills - Seek out challenges and trainings to improve your Analysis skillset.
• Get Creative - Take a proactive approach to problems encountered in your career and consider possible solutions you or the team can implement to overcome them.

2.0 Role Integrations

2.1 Collaboration with the Intelligence Team

Purpose

The Intelligence team provides the Tier 1 Cyber Security Analyst situational updates on the ever-changing Cyber Threat Landscape regularly. T1 Analyst should seek to leverage the knowledge provided to improve their contextual awareness for threats in their daily monitoring duties.

Requirements

• Stay Appraised: Attend weekly Threat Intelligence briefings (or download the recording/slides of the briefings) regularly to stay up-to-date on the latest changes to the Cyber Threat Landscape.
• Feedback Loop: Provide feedback to the intelligence team on the effectiveness and accuracy of the threat intelligence reports received. Share insights and observations from working with the threat hunting content and highlight any areas where additional or more specific information would be beneficial for improving the content's accuracy and relevance.

2.2 Collaboration with the Program Management Team

Purpose

The Program Management team handles the majority of the VSOC's administrative duties for our customer environments. Tier 1 Cyber Security Analysts should leverage the PM team to gain further insight into what their customer environments need from them as well for handling clerical tasks (such as requesting access for customer too