On-Site Threat Hunter: Cyber Defense Analyst

TEKsystems; Honolulu (HI); On-site; USD 69,000 - 95,000; Full time

Job summary

TEKsystems in Honolulu, Hawaii, seeks a Cyber Intrusion Analyst for an on-site SOC role supporting a DoD program. You will detect, investigate, and respond to network security incidents, guiding CSSP/CND-SP teams and maintaining enterprise-wide security.

Ideal candidates have 4+ years in CND, TS/Secret clearances, and hands-on experience with Splunk/Elastic, firewalls, and IDS/IPS. This is an on-site, contract-to-hire position with 5-day work weeks.

Qualifications

• At least 4 years of overall professional experience, preferably combined with a bachelors degree.
• Active Secret clearance, with an active Top Secret clearance preferred.
• Minimum of 2 years of Computer Network Defense (CND) analysis experience, including hands-on use of SIEM tools such as Splunk or other SIEM platforms.
• Prior experience performing CND duties across Protect, Defend, Respond, and Sustain functions, including configuring firewalls, IDS/IPS, auditing network traffic, hardening devices, and implementing security policies.
• Demonstrated experience monitoring IDS and computer defense appliances, specifically using tools such as Splunk and Elastic.
• Experience evaluating and interpreting packet captures and network traffic to identify security incidents.
• Proficiency with command-line scripting, particularly in PERL, Python, and/or Shell scripting, to automate operational and analytical tasks.
• Prior experience supporting Department of Defense-related projects or programs.
• Ability and willingness to work assigned shifts, including day, swing, or night schedules in a 24/7/365 SOC environment.
• Strong incident response, cyber security, and vulnerability assessment skills, including familiarity with SIEM-driven workflows.
• Possession of Security+ (or equivalent baseline security certification) in combination with a Top Secret clearance as a core requirement for the role.

Responsibilities

• Work closely with Government counterparts to provide expert guidance within the CND-SP area, ensuring alignment with mission needs and security objectives.
• Provide comprehensive CND reporting, including trends, responses, mitigations, analysis, and information dissemination to leadership and mission partners.
• Deliver command and control (C2) support and situational awareness for all CND activities across Protect, Detect, Respond, and Sustain functions.
• Serve as a technical leader within the CSSP team, responsible for maintaining the integrity and security of enterprise-wide systems and networks.
• Provide technical leadership to CND teams by supporting security initiatives through predictive and reactive analysis and clearly articulating emerging trends and threats to leadership and staff.
• Perform computer network incident detection and response activities to detect, correlate, identify, and characterize anomalous activity that may indicate threats to the enterprise.
• Monitor various security tools and applications, primarily Splunk and Elastic, for potential malicious activities and investigate associated alerts or indicators.
• Develop and recommend courses of action, including mitigation strategies, based on findings from security tools, logs, and network traffic analysis.
• Conduct analysis of low-level or "low and slow" events to identify unauthorized activity using exploratory problem-solving and self-learning techniques.
• Perform near real-time event triage and analysis, which may result in network traffic validation or the creation of incident reports for mission partners.
• Utilize formal monitoring policies and procedures, including DoD-approved network monitoring and traffic analysis tools, to identify suspicious, anomalous, or malicious network traffic on a 24/7/365 basis.
• Review and analyze available logs in a timely manner to detect intrusions and notify mission partners of relevant activity through formal reporting processes.
• Apply, develop, tune, and distribute or optimize new and existing countermeasures or guidance to prevent or mitigate potential cyber event impacts whenever possible.
• Perform detailed network traffic analysis using raw packet data, netflow, IDS, IPS, and custom sensor output to identify and understand security events.
• Configure and manage firewalls, IDS/IPS, and other security appliances to support Protect, Defend, Respond, and Sustain activities.
• Audit network traffic, harden devices, and implement security policies to enhance the overall security posture.
• Use command-line scripting (such as PERL, Python, and Shell) to automate tasks, streamline analysis, and improve operational efficiency.
• Support DOD-related projects or programs by providing cyber incident handling expertise and real-time analysis.
• Collaborate with other SOC analysts across multiple shifts to ensure continuous monitoring and consistent incident handling coverage.

Skills

4+ years experience

Active Secret clearance

Top Secret clearance preferred

CND analysis experience

Splunk experience

Elastic monitoring experience

Packet capture analysis

Scripting: PERL/Python/Shell

DoD experience

Shift work in 24/7 SOC

Incident response skills

Security+ with TS clearance

Education

Bachelor's degree preferred

Tools

Splunk

Elastic

IDS/IPS

Firewalls configuration

Job description

TEKsystems in Honolulu, Hawaii, seeks a Cyber Intrusion Analyst for an on-site SOC role supporting a DoD program. You will detect, investigate, and respond to network security incidents, guiding CSSP/CND-SP teams and maintaining enterprise-wide security.

Ideal candidates have 4+ years in CND, TS/Secret clearances, and hands-on experience with Splunk/Elastic, firewalls, and IDS/IPS. This is an on-site, contract-to-hire position with 5-day work weeks.