Cyber Security Ops Specialist II — Tier 2 (Flexible PTO)

VulnU; St. Louis (MO); On-site; USD 63,000 - 130,000; Full time

Benefits offered by this job

Flexible PTO

Learning budget

Retirement match

Job summary

CACI is seeking a Cyber Security Operations Specialist II/Tier 2 in St. Louis, MO to join the 24x7 CSOC. You will lead investigations, perform deep-dive log analysis, and collaborate with senior responders to mitigate threats and ensure mission resilience.

Responsibilities include leveraging Splunk, Elastic, and Microsoft Sentinel, applying threat intelligence, and documenting actions for repeatable incident response. A TS/SCI with poly is required or in progress within set timelines.

Qualifications

• Bachelor's degree or equivalent experience.
• Active TS/SCI clearance is required to start; CI Poly within 6 months is preferred.
• 4+ years of related work experience in CSOC or incident response.

Responsibilities

• Lead investigations into escalated cyber events and build robust case files.
• Perform deep-dive correlation and analysis of security events using SIEMs.
• Track threat intrusion sets and identify IoCs within the enterprise.
• Document findings in ITSM system with meticulous detail for reproducibility.
• Identify insider threats and escalate to counterintelligence as needed.
• Evaluate and classify incidents per CJCSM 6510.01B criteria.
• Support enterprise network architecture and placement of security devices.
• Participate in major Cyber Incident Response operations and crisis events.

Skills

Threat analysis

Incident response

Log analysis

Team mentorship

Security tooling

Education

BA/BS degree

Tools

Splunk

Elastic

Microsoft Sentinel

Job description

CACI is seeking a Cyber Security Operations Specialist II/Tier 2 in St. Louis, MO to join the 24x7 CSOC. You will lead investigations, perform deep-dive log analysis, and collaborate with senior responders to mitigate threats and ensure mission resilience.

Responsibilities include leveraging Splunk, Elastic, and Microsoft Sentinel, applying threat intelligence, and documenting actions for repeatable incident response. A TS/SCI with poly is required or in progress within set timelines.