Cybersecurity Ops Analyst

SAIC; Tennessee; Remote; USD 40,000 - 80,000; Full time

Job summary

SAIC is seeking a Cybersecurity Ops Analyst to join the 24/7/365 ESOC. The role may work remotely anywhere in the United States, on 2nd shift (2pm-midnight) or 3rd shift (10pm-8am EST).

You will monitor, investigate, and respond to security events using SIEM and EDR tools, collaborating with GRC, architecture, and detection engineering teams. Ideal candidates have a Security+ and CySA+ certification, plus hands-on security operations experience, strong analytical and communication skills, and

Qualifications

• Bachelor’s degree with 2+ years of cybersecurity operations experience.
• U.S. Citizen.
• Minimum 2 years of cybersecurity operations experience.
• Must possess Security+ AND CySA+ certifications.
• Hands-on experience with SIEM and EDR technologies.
• Experience triaging incidents and escalation procedures.
• Knowledge of Windows, Linux and cloud environments.
• Understanding of MITRE ATT&CK framework in investigations.
• Strong written and verbal communication skills.

Responsibilities

• Monitor, triage, and investigate security alerts in ESOC.
• Analyze network, endpoint, system, and cloud telemetry using SIEM and EDR.
• Execute approved response actions and escalate as needed.
• Participate in proactive threat hunting to identify gaps.
• Document investigations and actions in incident system.
• Contribute to SOC continuous improvement and procedures.
• Support onboarding and training of new analysts.

Skills

SIEM

EDR

Incident response

Threat hunting

Network security

Windows OS

Linux OS

Cloud environments

MITRE ATT&CK

Communication skills

Education

Bachelor’s degree or 4+ years related experience

Tools

Splunk ES

Security+ certification

CySA+ certification

Job description

Minimum Clearance Required None

Job ID 2618389

Location Remote Work, TN, US

Date Posted 2026-10-23

Category Cyber

Subcategory Cybersecurity Ops

Schedule Full-Time

Shift Evening Job

Travel No

Minimum Clearance Required None

Clearance Level Must Be Able to Obtain None

Minimum Clearance Required None

Potential for Remote Work ORA_REMOTE

Description

SAIC has an opening for a Cybersecurity Ops Analyst. For the right candidate, SAIC is open to the position working remotely anywhere in the United States. This position will either work 2nd shift (2pm-midnight) or third shift (10pm-8am EST). The SAIC Cybersecurity Ops Analyst performs advanced security event analysis as part of the 24/7/365 Enterprise Security Operations Center (ESOC) Detection & Response team. This role is highly technical and hands-on, using a SIEM and endpoint detection and response (EDR) tools to monitor, analyze, and respond to security events from multiple sources. Analysts are responsible for intrusion detection, incident investigation, triage and initial response, and continuous improvement of detection capabilities and response procedures. They also participate in intelligence gathering and contribute to improving procedures and processes within the ESOC. This position requires independent technical judgment, the ability to investigate complex security events, and collaboration with other cybersecurity teams (GRC, architecture, detection engineer, etc.).

Job Duties

• Independently monitor, triage, and investigate security alerts and anomalous activity, determining severity, scope, potential impact, and appropriate response actions.
• Perform in-depth security investigations by analyzing and correlating network, endpoint, system, and cloud telemetry using SIEM and EDR technologies. Evaluate suspicious activity, threat intelligence, and vulnerability information to identify potential threats and assess organizational risk.
• Execute approved response actions, including IP/URL/Hash blocks, endpoint isolation, and escalating confirmed or suspected incidents to appropriate incident response teams.
• Participate in proactive threat hunting activities to identify suspicious behavior, indicators of compromise and potential detection gaps.
• Document investigations, findings, supporting evidence, and response actions accurately and consistently in the incident tracking system.
• Contribute to SOC continuous improvement through detection tuning recommendations, process enhancements, and updates to procedures and documentation.
• Support the onboarding and training of new analysts through knowledge sharing, cross-training, and technical assistance.

Qualifications

Required Education and Experience

• Bachelor’s degree and 2+ years of experience or an Associate’s degree in related discipline and 3+ years or more experience. An additional 4+ years of experience may be considered in lieu of a degree.
• Must be a US Citizen.
• Must have a minimum 2 years of cybersecurity operations related experience.
• Must possess the following certification(s) Security+ AND CySA+.
• Hands‑on experience with SIEM and EDR technologies, including security alert investigation, endpoint analysis, and correlation of security events.
• Experience triaging security incidents, assessing severity and potential impact, and determining appropriate escalation procedures.
• Working knowledge of network security fundamentals and identification of suspicious network activity.
• Working knowledge of Windows, Linux, and cloud environments, including relevant security logs, events and telemetry.
• Understanding of common attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CK framework and its application to security investigations.
• Ability to independently investigate complex or unfamiliar security events, exercise sound technical judgment, and communicate investigative findings.
• Strong written and verbal communication skills, including the ability to clearly document investigations and coordinate with technical and non-technical stakeholders.
• Ability to effectively share technical knowledge and provide guidance to less experienced analysts.

Preferred Qualifications

• Hands‑on experience with Splunk Enterprise Security (ES).
• Experience participating in the full incident response lifecycles, including containment, eradication, recovery and post‑incident analysis.
• Experience conducting proactive threat hunts, identifying detection gaps, and contributing to detection tuning and improvements.
• Familiarity with scripting or automation using Python, PowerShell, or similar technologies to support security investigations and operational efficiency.

Target salary range $40,001 - $80,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.