Federal SOC Analyst: Threat Detection, IR & Forensics

Expression; Washington (District of Columbia); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

401k matching

PPO and HDHP medical/dental/vision

Education reimbursement up to $10,000/

Complimentary life insurance

Generous PTO and 11 holidays

Onsite gym facility at HQ in DC

Commuter Benefits Plan

Job summary

Expression is seeking a SOC Analyst to join our team in Washington, DC, onsite, to support the NTIA ISCOM Division. You will monitor, analyze, and respond to cyber threats to bolster federal network resilience and situational awareness.

The role covers Tier 1/2 operations, malware analysis, network forensics, threat hunting, and collaboration with cyber teams to improve detection content and SOC playbooks. Active Secret or Top Secret clearance is required.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or related field.
• OR equivalent certifications (CompTIA Security+, CISSP, GCIH, GCIA).
• Minimum of 4 years of experience in security operations, incident response, or cyber threat analysis.
• Strong knowledge of SOC operations, incident detection, and response workflows.
• Familiarity with malware analysis, network forensics, and packet-level inspection.
• Excellent analytical, problem-solving, and communication skills.

Responsibilities

• Monitor, detect, and analyze security threats, risks, and alerts using SOC tools, and initiate escalation as required.
• Conduct cyber threat analysis and contribute to reports for program situational awareness.
• Provide Tier 1 response to security incidents and support escalation to Tier 2 during high-volume or critical events.
• Conduct functional incident response teams during shifts, ensuring accountability and effective resolution.
• Conduct malware analysis (static and dynamic) and assess Indicators of Compromise (IOCs).
• Perform network forensics and deep packet inspection to investigate intrusions.
• Implement remediation strategies and support recovery activities after incidents.
• Recommend process improvements and create new detection content to strengthen SOC operations.
• Conduct proactive monthly threat hunts and provide reports to stakeholders.
• Collaborate with cyber teams for incident escalation, coordinated responses, and SOC policy/procedure development.

Skills

SOC operations

Incident detection

Threat analysis

Communication skills

Problem solving

Team collaboration

Education

Bachelor’s degree in Cybersecurity/CS/IS

Certifications such as Security+, CISSP, GCIH, GCIA

Tools

SIEM platforms

IDS/IPS

Endpoint monitoring tools

Job description

Expression is seeking a SOC Analyst to join our team in Washington, DC, onsite, to support the NTIA ISCOM Division. You will monitor, analyze, and respond to cyber threats to bolster federal network resilience and situational awareness.

The role covers Tier 1/2 operations, malware analysis, network forensics, threat hunting, and collaboration with cyber teams to improve detection content and SOC playbooks. Active Secret or Top Secret clearance is required.