Remote Tier 2 SOC Analyst — Threat & Incident Response

Leidos; Alexandria (VA); On-site; USD 70,000 - 126,000; Full time

Job summary

Leidos is seeking experienced Tier 2 Security Operations Center (SOC) Analysts to support the DMDC CyberPRIMES program. The role involves advanced analysis of cybersecurity events escalated from Tier 1, correlating security data, and supporting incident triage and containment to protect DHRA and DMDC systems.

The team operates in a 24x7 environment; candidates require U.S. citizenship and an active Secret clearance, plus experience with SIEM platforms and enterprise monitoring.

Qualifications

• BS degree or equivalent with 2+ years of relevant experience; or a Masters with less than 2 years.
• Experience performing cybersecurity event analysis, SOC operations, cyber defense, incident triage, or security monitoring.
• Experience analyzing and correlating alerts from multiple monitoring capabilities.
• U.S. Citizenship and Active Secret security clearance required.
• Ability to document investigations clearly and work in a 24x7 team.

Responsibilities

• Perform advanced analysis of cybersecurity events escalated from Tier 1.
• Correlate alerts and telemetry to determine severity and impact.
• Distinguish legitimate activity from false positives and incidents.
• Contain or mitigate identified threats per SOC playbooks.
• Preserve evidence and document actions in government-approved systems.
• Coordinate with incident responders and other teams.

Skills

Cybersecurity analysis

SOC operations

Incident triage

Security monitoring

Threat correlation

Teamwork in 24x7

Education

BS degree or equivalent

Masters (less than 2 yrs exp)

Tools

SIEM platforms

Enterprise monitoring tools

Security analysis tools

Job description

Leidos is seeking experienced Tier 2 Security Operations Center (SOC) Analysts to support the DMDC CyberPRIMES program. The role involves advanced analysis of cybersecurity events escalated from Tier 1, correlating security data, and supporting incident triage and containment to protect DHRA and DMDC systems.

The team operates in a 24x7 environment; candidates require U.S. citizenship and an active Secret clearance, plus experience with SIEM platforms and enterprise monitoring.