Cyber Defense Operator – Intermediate

Viranim Technical Solutions; San Antonio (TX); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Paid holidays

Paid time off

Medical insurance

Dental & vision insurance

FSAs

HSA

Disability insurance

Life insurance

401(k) match

Job summary

Viranim Technical Solutions seeks a Cyber Defense Operator at Lackland AFB in San Antonio, TX to monitor, detect, and respond to cyber threats in a DoD environment. You will review IDS/IPS alerts, analyze events, and coordinate incident responses.

Applicants should hold GCFA and Top Secret/SCI clearance. The role emphasizes procedural development for host monitoring, situational awareness, and clear reporting to mission support systems, with a focus on accuracy and rapid triage.

Qualifications

• GCFA certification required.
• Top Secret/SCI clearance required.

Responsibilities

• Review IDS/IPS alerts and conduct host security monitoring per SOP.
• Develop and maintain procedures for monitoring hosts and systems.
• Analyze DCO events to determine need for higher-level analysis.
• Monitor sensors to identify and correlate security events and review logs.
• Record activity in case management system for investigations.
• Escalate incidents per policy and provide monthly performance metrics.

Skills

GCFA

TS/SCI Clearance

Job description

Viranim is seeking a Cyber Defense Operator at Lackland AFB in San Antonio, TX.

What You'll Do:

• Review all IDS/IPS alerts per AFIN SOC Operating Instruction and checklists at the AOL, COOP, or Ops Floor. Conduct host security monitoring, alert review, and intrusion detection analysis for the AFIN-SOC mission.
• Develop, Review and Maintain procedures related to the overall monitoring of Hosts/Systems.
• Comply with 3rd party MOU/MOA monitoring and reporting requirements. Analyze host DCO events to determine the necessity for higher level analysis and conduct an initial assessment of type and extent of intruder activities.
• Monitor security sensors to analyze Intrusion Detection Systems and Security Information and Event Management to identify and correlate security issues/events and review logs to identify intrusions for remediation. Correlate suspicious events with network events, if possible, and data stored within databases and other external DoD resources, including but not limited to Big Data Platform.
• Analyze traffic/logs/events to determine the necessity for higher level analysis and conduct an initial assessment of type and extent of intruder activities.
• Record who, what, where why and when for any identified suspicious activity in case management system case to enable additional investigations.
• Conduct triage of suspicious activity alerts and logs in order to make a fast and accurate triage decision.
• Enter event data into mission support systems in accordance with AFIN SOC operational procedures and reports.
• Provide monthly performance metrics including but not limited to readiness, qualifications, events processed, CAT events and incidents identified.
• Escalate security incidents using established policies and procedures.

What You Bring:

• GCFA
• Top Secret/SCI Clearance

What We Offer:

• paid holidays
• paid time off
• medical
• dental and vision insurance
• flexible spending accounts
• health savings accounts
• short and long term disability
• company paid life insurance
• 401(k) with a company match