Cybersecurity Defense Analyst II

Invictus International; Alexandria (VA); On-site; USD 90,000 - 140,000; Full time

Job summary

Invictus International is seeking a security analyst to independently monitor, triage, and investigate routine and moderately complex security alerts, performing cyber defense monitoring across enterprise systems and telemetry.

The role requires DoD 8570 IAM II or IAT II, active TS/SCI clearance with CI poly, and experience in a DoD or IC environment; a Bachelor's degree with 4 years experience and strong analytical, communication skills are required for documenting findings and coordinating

Qualifications

• Bachelor's degree or higher in a technical field; four years may substitute for degree.
• Minimum four years of relevant security experience.
• Knowledge of TCP/IP, DNS, HTTP/S, authentication, enterprise networking, Windows/Linux security events.
• Hands-on experience with SIEM and multiple security technologies.
• Ability to investigate security activity and communicate evidence-based conclusions.
• Must possess DoD 8570 IAT II or IAM II certification.
• Experience in a DoD or IC environment.
• Active TS/SCI clearance with the ability to obtain and maintain a CI polygraph.

Responsibilities

• Independently monitor, triage, and investigate routine and moderately complex security alerts and suspected incidents.
• Perform cyber defense monitoring and analysis using security data from enterprise systems, networks, sensors, and telemetry.
• Analyze logs and network activity to identify anomalous behavior and document findings in the case system.
• Perform cyber defense incident triage, including validation, enrichment, scope, urgency, impact, and escalation.
• Support incident handling across detection, investigation, containment, remediation, recovery, and reporting.

Skills

SIEM

Incident response

Log analysis

Network security

DoD 8570 IAM II

Education

Bachelor's degree

Tools

Job description

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph

• Independently monitor, triage, and investigate routine and moderately complex security alerts and suspected incidents.
• Perform cyber defense monitoring and analysis using security information from enterprise systems, networks, security sensors, firewalls, intrusion detection/prevention technologies, endpoint sources, and other available telemetry.
• Analyze log files and network activity to identify anomalous or malicious behavior, determine potential security impact, and document investigative findings in the authorized case or ticketing system
• Perform cyber defense incident triage, including validation, enrichment, determination of scope, urgency, potential impact, and appropriate escalation
• Support incident handling across detection, investigation, analysis, containment/remediation coordination, recovery, and reporting in accordance with established authorities and procedures
• Correlate incident and security data across multiple sources to identify affected systems, users, vulnerabilities, adversary activity, and related events
• Collect and preserve relevant intrusion artifacts and investigative evidence in accordance with established procedures
• Communicate incident status, findings, risk, and recommended actions to SOC personnel, technical teams, management, and government stakeholders as appropriate
• Develop and test investigative hypotheses by correlating network, host, identity, firewall, vulnerability, and threat data
• Identify related activity beyond the initially alerted system and appropriately expand investigative scope
• Execute established incident response and escalation procedures and coordinate with technical teams when containment or remediation action is required
• Identify recurring alert-quality, telemetry, or process issues and recommend improvements to senior analysts

Requirements:

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree
• Minimum four (4) years of relevant experience in addition to education level
• Working knowledge of TCP/IP, DNS, HTTP/S, authentication, enterprise networking, Windows/Linux security events, and common adversary techniques
• Hands-on experience using SIEM and one or more network, endpoint, firewall, IDS/IPS, or security-analysis technologies
• Ability to independently investigate security activity, distinguish facts from assumptions, and communicate evidence-based conclusions
• Must possess current DoD 8570 IAT II or IAM II certification
• Experience working in a DoD or IC environment
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

Equal Opportunity Employer/Veteran/Disabled

Helping all candidates find great careers is our goal. The information you provide here is secure and confidential.