Security Operations Center Cyber Analyst

Arcfield; Newport (RI); Hybrid; USD 64,000 - 112,000; Full time

Benefits offered by this job

Health Insurance

Life Insurance

Paid Time Off

Holiday Pay

Short Term and Long-Term Disability

Retirement and Savings

Learning and Development opportunities

wellness programs

other optional benefit elections

Job summary

Arcfield seeks a Cyber-Intelligence Analyst II to monitor security events using Splunk and Airlock Digital, investigate alerts, and support threat detection and incident response. The role requires strong SOC experience, knowledge of SIEM/XDR tools, AD and Windows Server administration, and compliance with security standards.

A DoD security clearance is required. Responsibilities include engineering detection analytics, identifying gaps, and collaborating with ISSOs and engineers to resolve

Qualifications

• 6+ years experience in Security Operations Center processes and using SIEM and XDR tools.
• Understand and respond to security detections in a SIEM adhering to Incident Response Processes.
• Strong background in Security Compliance & Vulnerability Management.
• Experience deploying enterprise tools on Domain Computers, including Antivirus and endpoint protection and vulnerability scanning.
• Proficient in Active Directory (AD) & Domain Controller (DC) Administration.
• Knowledge of Windows Server Administration and CIS/DISA STIG baselines.
• CompTIA Security+ CE.
• Active Secret DoD Security Clearance required for this role.

Responsibilities

• Monitor and analyze security events in Splunk and Airlock Digital. Analyst on Duty: Investigate alerts that are triggered in the Splunk Console to determine if a threat or normal activity is allowed in the environment.
• Provide threat detection and incident response to mitigate risks to the Network
• Security Detection Engineering: troubleshoot, improve and develop security detection analytics. able to determine detection gaps and draft analytics to correct them
• Interpreting activity to determine what is malicious vs expected across Windows/Linux workstations and servers, Firewall, Switch, Router, Endpoint Security, Wireless IDS, and other logs; proficiency in scripting languages (PowerShell, Python, Bash)

Skills

Scripting languages

Incident response

Threat detection

Education

Bachelor's degree

Master's degree

Tools

SIEM/XDR tools

Active Directory

Windows Server

Endpoint protection

Vulnerability scanning

Job description

Responsibilities

• Monitor and analyze security events in Splunk and Airlock Digital. Analyst on Duty: Investigate alerts that are triggered in the Splunk Console to determine if a threat or normal activity is allowed in the environment.
• Provide threat detection and incident response to mitigate risks to the Network
• Security Detection Engineering: troubleshoot, improve and develop security detection analytics. able to determine detection gaps and draft analytics to correct them
• Experience in interpreting activity to determine what is malicious vs expected from a variety of sources such as Windows and Linux workstations and servers, Firewall, Switch, Router, Endpoint Security, Wireless Intrusion Detection, and other security and application logs Proficiency in scripting languages (PowerShell, Python, Bash, etc.)

Cyber-Intelligence Analyst II, I07, SICIEI07

Qualifications

• BS 2-4 Years, MS 0-2
  6+ Years experience in Security Operations Center processes and using SIEM and XDR tools
• Security Operations Center Analyst: Understand and respond to security detections in a SIEM adhering to Incident Response Processes. Ability to collect relevant information from network and host logs, correlate events together to develop incident timelines and deduce root cause. Collaborate with ISSOs and engineers/developers/admins to resolve security incidents
• Strong background in Security Compliance & Vulnerability Management. Familiarity with adhering to Cybersecurity Standard Operating Procedures, ability to review and update SOP documents for clarity and accuracy.
• Prior experience with deploying enterprise tools on Domain Computers, including Antivirus, endpoint protection, and vulnerability scanning
• Proficient in Active Directory (AD) & Domain Controller (DC) Administration
• Knowledge of Windows Server Administration, including Windows Server 2019/2022/2025 internals, registry, event logs, and system services
• Experience with Windows security baselines (CIS, DISA STIG)
• CompTIA Security+ CE
• Active Secret DoD Security Clearance required for this role

Equal Pay Act

This is the projected compensation range for this position. There are differentiating factors that can impact a final salary/hourly rate, including, but not limited to, Contract Wage Determination, relevant work experience, skills and competencies that align to the specified role, geographic location (For Remote Opportunities), education and certifications as well as Federal Government Contract Labor categories. In addition, Arcfield ’s benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, Short Term and Long-Term Disability, Retirement and Savings, Learning and Development opportunities, wellness programs as well as other optional benefit elections.Min: $64,252.03Max: $111,721.81

• Health Insurance
• Life Insurance
• Paid Time Off
• Holiday Pay
• Short Term and Long-Term Disability
• Retirement and Savings
• Learning and Development opportunities
• wellness programs
• other optional benefit elections

EEO Statement

We are an equal opportunity employer and federal government contractor. We do not discriminate against any employee or applicant for employment as protected by law.