Remote Cybersecurity Ops Analyst - 2nd/3rd Shift

SAIC; United States; Remote; USD 80,000 - 110,000; Full time

Job summary

SAIC seeks a Cybersecurity Ops Analyst to join its Enterprise Security Operations Center (ESOC) in a 24/7 environment. The role is hands-on, focused on detecting and responding to security events across network, endpoint, and cloud telemetry using SIEM and EDR tools.

Responsibilities include incident investigation, triage, containment actions, and collaboration with GRC, architecture, and detection engineering teams.

Qualifications

• Bachelor's degree plus 2+ years of related experience or Associate's degree plus 3+ years of experience
• Security+ and CySA+ certifications required
• Hands-on experience with SIEM and EDR technologies and investigation of security events
• Experience triaging security incidents and determining escalation procedures
• Knowledge of Windows, Linux and cloud environments and relevant security logs

Responsibilities

• Monitor, triage, and investigate security alerts and anomalies using SIEM/EDR tools
• Conduct in-depth investigations by correlating network, endpoint, system, and cloud telemetry
• Execute approved response actions (IP/URL/Hash blocks, endpoint isolation)
• Participate in proactive threat hunting and identify detection gaps
• Document investigations and actions in incident tracking system
• Contribute to ESOC improvements and knowledge sharing

Skills

Cybersecurity operations

Threat hunting

Incident response

Communication skills

Analytical thinking

Team collaboration

Scripting (Python/PowerShell)

MITRE ATT&CK

SIEM/EDR usage

Threat intelligence

Education

Bachelor's degree

Associate's degree

Security+ and CySA+ certifications

Tools

SIEM

EDR

Splunk Enterprise Security

PowerShell

Job description

SAIC seeks a Cybersecurity Ops Analyst to join its Enterprise Security Operations Center (ESOC) in a 24/7 environment. The role is hands-on, focused on detecting and responding to security events across network, endpoint, and cloud telemetry using SIEM and EDR tools.

Responsibilities include incident investigation, triage, containment actions, and collaboration with GRC, architecture, and detection engineering teams.