Cyber Defense Operator – Intermediate

SMS DATA PRODUCTS GROUP, INC; San Antonio (TX); On-site; USD 110,000 - 150,000; Full time

Job summary

SMS DATA PRODUCTS GROUP, INC is seeking a Cyber Defense Operator to support AFCERT missions through continuous near real time network security monitoring and intrusion detection across the Air Force Information Network. You will operate within the HAC to sustain MR status and support 24x7x365 mission operations.

The role requires a minimum of five years in cyber defense, DoD/IC clearance, GCFA, and familiarity with Kill Chain, MITRE ATT&CK, and NIST frameworks, with strong emphasis on SIEM/EDR

Qualifications

• Minimum of five years in cyber defense operations within a DoD or IC environment.
• Active DoD TSSCI clearance required.
• High School Diploma or GED required.
• GCFA certification.
• Candidate has 120 days to obtain GCFA after hire.
• Knowledge of Cyber Kill Chain, MITRE ATT&CK, and NIST 800-series frameworks.
• Knowledge of computer components, architectures, TCP/IP, OSI models, and related networking concepts.
• Self-motivated and able to perform with minimal supervision.

Responsibilities

• Conduct near real time network security monitoring and intrusion detection analysis across networks and systems.
• Review IDS/IPS alerts per operating instructions and checklists.
• Conduct host security monitoring and event triage.
• Develop, review, and maintain procedures for monitoring hosts/systems.
• Monitor sensors to analyze IDS/IPS and SIEM data to identify issues and review logs for remediation.
• Correlate suspicious events with network data and external DoD resources.
• Analyze traffic logs to determine necessity for deeper analysis and initial intrusion assessment.
• Record activity details in the CMS to enable investigations.
• Triage suspicious activity alerts to make fast, accurate decisions.
• Enter event data into mission support systems per procedures and reports.
• Escalate security incidents following established policies.

Skills

GCFA

DoD IC environment

Self-motivated

Education

High School Diploma or GED

Tools

SIEM

EDR

Packet capture

Job description

The Cyber Defense Operator CDO supports the Air Force Computer Emergency Response Team AFCERT mission by providing continuous near real time network security monitoring intrusion detection analysis and host security monitoring across the Air Force Information Network AFIN The CDO operates as a member of the DCO Hunt and Assess Crew HAC and is required to attain and maintain Mission Ready MR status in accordance with applicable Air Combat Command Instructions ACCI and ACCMANs governing the AFIN weapon system This position supports 24x7x365 mission operations across rotating crew schedules Since 1976 SMS has specialized in modernizing legacy IT and sustaining complex enterprise environments for federal agencies With the goal of building long term partnerships with our customers we invest in our employees by providing the training tools and support they need to keep critical missions operational improve performance and reduce risk SMS is headquartered in McLean Virginia with offices and on site operations at customer locations throughout the United States For additional information on SMS visit wwwsmscom Submit your resume today

Job Responsibilities

• Conduct near real time network security monitoring and intrusion detection analysis across networks and systems
• Review IDSIPS alerts per Operating Instruction OI and checklists
• Conduct host security monitoring alert review intrusion detection analysis and event analysis and triage
• Develop Review and Maintain procedures related to the overall monitoring of HostsSystems
• Monitor security sensors to analyze Intrusion Detection Systems IDS and Security Information and Event Management SIEM to identify and correlate security issuesevents and review logs to identify intrusions for remediation
• Correlate suspicious events with network events if possible and data stored within databases and other external DoD resources
• Analyze trafficlogsevents to determine the necessity for higher level analysis and conduct an initial assessment of type and extent of intruder activities
• Record who what where why and when for any identified suspicious activity in case management system CMS to enable additional investigations
• Conduct triage of suspicious activity alerts and logs in order to make a fast and accurate triage decision
• Enter event data into mission support systems in accordance with operational procedures and reports
• Escalate security incidents using established policies and procedures
• Generate end of mission reports MISREPS and provide pass on information for knowledge transfer to subsequent crews of analysts on duty regarding the latest suspicious traffic seen from a given port Internet Protocol IP etc
• Provide computer security related support to AF field units
• Provide feedback on detection mechanisms that are both true and false positive events to Content Development as applicable

Required Qualifications

• A minimum of five 5 years of experience in cyber defense operations network security monitoring intrusion detection analysis or a related discipline within a DoD or Intelligence Community environment
• Active DoD TSSCI clearance required
• High School Diploma or GED required
• GCFA certified
• Candidate has 120 days to obtain GCFA after hire
• General knowledge of cyber security frameworks such as the Cyber Kill Chain MITRE ATT&CK and the NIST 800 series
• General knowledge of physical computer components and architectures including the functions of computer domains directory services various components and peripherals basic programming concepts assembly codes TCPIP OSI models underlying networking protocols eg DNS ARP etc security hardware and software
• Candidate must be self motivated and able to perform with minimal supervision

Preferred Qualifications

• Knowledge of cyber forensic collection preservation and chain of custody
• Prior AFCERT DCO SOC experience supporting government networks
• Experience with endpoint and network security tooling such as SIEM EDR packet capture IDSIPS and case management workflows
• Familiarity with producing operational deliverables in a regulated environment formal ticketing incident timelines evidence handling

SMS is an Equal Opportunity Employer All qualified applicants will receive consideration for employment without regard to race color religion sex sexual orientation gender identity national origin disability or status as a protected veteran

Req 2026