Cyber Defense Operations Analyst, TS/SCI (Onsite)

IBM; Maryland; On-site; USD 69,000 - 119,000; Full time

Job summary

IBM Consulting is seeking a Technical Operations Analyst to safeguard client digital infrastructure. The role focuses on identifying and mitigating cyber threats, with responsibilities to investigate incidents using SIEM/SOAR/EDR/XDR and apply MITRE ATT&CK and Cyber Kill Chain.

Responsibilities include prioritizing incident reports, analyzing Windows, macOS and Linux logs, and contributing to vulnerability management and threat intelligence efforts to strengthen client security resilience.

Qualifications

• Experience with cybersecurity tools and incident response processes.
• Familiarity with MITRE ATT&CK and the Cyber Kill Chain framework.
• Ability to analyze logs from Windows, macOS and Linux systems.
• Knowledge of vulnerability management and threat intelligence activities.
• Active TS/SCI clearance and IAT Level II certification are required.

Responsibilities

• Investigate security incidents using SIEM, SOAR, EDR and XDR platforms.
• Prioritize incident reports and provide actionable remediation recommendations.
• Analyze network and endpoint events to identify potential threats.
• Participate in vulnerability management and threat intelligence activities.
• Deliver security recommendations to enhance client security posture.

Skills

Cybersecurity Tools

MITRE ATT&CK

Cyber Kill Chain

Network Analysis

Vulnerability Management

Security Clearance TS/SCI

IAT Level II

Education

High School Diploma

Bachelor's Degree

Tools

SIEM

SOAR

EDR

XDR

Job description

IBM Consulting is seeking a Technical Operations Analyst to safeguard client digital infrastructure. The role focuses on identifying and mitigating cyber threats, with responsibilities to investigate incidents using SIEM/SOAR/EDR/XDR and apply MITRE ATT&CK and Cyber Kill Chain.

Responsibilities include prioritizing incident reports, analyzing Windows, macOS and Linux logs, and contributing to vulnerability management and threat intelligence efforts to strengthen client security resilience.