Security Ops Analyst

Altus Consulting Corp; Reston (VA); Presencial; USD 120 000 - 160 000; Tempo integral

Resumo da oferta

Altus Consulting Corporation seeks mid-level SecOps Analysts to support continuous security monitoring, incident triage, investigation and response within a 24/7/365 cleared cloud Security Operations Center. You will monitor telemetry, enrich events, document findings and own incidents through escalation and closure.

This role targets disciplined security professionals with SOC, cyber defense, or incident response backgrounds, including cleared IT operations. TS/SCI required.

Qualificações

• Active TS/SCI clearance with Full Scope Polygraph is required.
• U.S. Citizenship is required.
• Three or more years in Security Operations or related fields.
• Hands-on experience with SIEM, IDS, EDR, and case-management tools.
• Experience supporting Windows and Linux environments and network infrastructure.
• Familiarity with cloud security and incident response practices.

Responsabilidades

• Continuously monitor security alerts and events using SIEM/EDR and other platforms.
• Perform initial triage, enrichment, correlation, and investigation of alerts.
• Categorize and prioritize incidents; maintain ownership through closure.
• Develop diagnostic summaries and document indicators of compromise.
• Create and maintain security cases using ticketing systems; escalate per procedures.
• Collaborate with SecOps teams to resolve security events and improve detections.

Conhecimentos

SOC operations

SIEM

EDR

Incident response

ServiceNow

Kubernetes

Python

PowerShell

Cloud security

Ferramentas

Splunk

Elastic/ELK

Google SecOps/Chronicle

Descrição da oferta de emprego

SecOps Analyst

Employment Type:

Full Time

Directorate:

Cyber Security Engineering

Location:

Northern Virginia, Tysons Corner / Reston

Clearance:

Active TS/SCI with Polygraph Required

Experience Level:

Mid-Level, 3+ Years

Altus Consulting is seeking skilled SecOps Analysts to support continuous security monitoring, incident triage, investigation, and response within a 24/7/365 cleared cloud Security Operations Center. The selected candidates will monitor security telemetry, investigate alerts, enrich events with relevant context, document findings, and maintain ownership of security incidents through escalation and closure.

This position is ideal for disciplined security professionals who thrive in an operational environment and take pride in high-quality analysis, documentation, and teamwork. Candidates with backgrounds in SOC operations, cyber defense, military cyber operations, incident response, or cleared IT operations are encouraged to apply.

RESPONSIBILITIES:

• Continuously monitor security alerts and events using SIEM, EDR, IDS, and other cybersecurity platforms.
• Perform initial alert triage, enrichment, event correlation, and investigation.
• Categorize and prioritize security incidents based on severity, impact, and established procedures.
• Maintain ownership of assigned alerts throughout investigation, escalation, documentation, and closure.
• Develop clear diagnostic summaries documenting observed activity, analysis performed, indicators of compromise, and recommended disposition.
• Create and maintain security cases using ServiceNow or other designated case-management platforms.
• Escalate incidents in accordance with established SecOps procedures and runbooks.
• Perform structured handoffs for active High and Critical incidents between shifts.
• Support incident documentation, security reporting, situational awareness, and operational metrics.
• Identify opportunities to improve security detections, playbooks, and response processes.
• Collaborate with SecOps Managers, security engineers, incident responders, and other technical teams to resolve security events.

PREFERRED SKILLS:

• Experience working in a Security Operations Center, Cyber Defense Team, Cyber Incident Response Team, military cyber organization, or similar operational environment.
• Hands-on experience with Splunk, Elastic/ELK, Google SecOps/Chronicle, or comparable SIEM technologies.
• Experience with EDR, IDS/IPS, network monitoring, and security case-management platforms.
• Experience with ServiceNow or comparable ticketing and case-management tools.
• Familiarity with Google Cloud security capabilities, including Security Command Center, Cloud Audit Logs, IAM, and GKE.
• Knowledge of MITRE ATT&CK, threat hunting, detection engineering, and incident response practices.
• Experience supporting Windows and Linux systems and network infrastructure.
• Familiarity with Kubernetes or air-gapped computing environments.
• Python or PowerShell scripting experience.
• Previous experience supporting classified, SCIF, Intelligence Community, Department of Defense, or Federal cybersecurity environments.

BASIC QUALIFICATIONS:

• Active TS/SCI clearance with Full Scope Polygraph is required.
• U.S. Citizenship is required.
• Three or more years of experience in Security Operations, Cyber Security, Systems Administration, or a comparable technical operations environment.
• Hands-on experience with SIEM, IDS, EDR, and case-management or ticketing technologies.
• Experience supporting Windows and Linux environments, network infrastructure, and security applications.
• Working knowledge of network analysis, vulnerability scanning, and security hardening practices.
• Strong analytical, documentation, written, and verbal communication skills.
• Ability to support a 24/7 operational environment, including assigned day, swing, night, weekend, or holiday coverage.
• Ability to satisfy customer-specific onboarding, access, training, and qualification requirements.

REQUIRED / QUALIFYING CERTIFICATIONS:

Candidates must possess an applicable Cyber Defense Analyst role-qualifying certification prior to performing billable work. Applicable certifications identified for this position include:

• CompTIA CySA+
• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Certified Incident Handler (GCIH)
• Certified Ethical Hacker (CEH)
• CISSP