Senior Cyber Defense Analyst

SOS International LLC; Waipahu (HI); On-site; USD 110,000 - 149,000; Full time

Job summary

SOSi is seeking a Senior Cyber Defense Analyst Lead for the INDOPACOM Network Security Operations Center. You will orchestrate cyber operations across multi-enclave environments, leveraging AI-enhanced threat detection and real-time analytics to disrupt threats before they impact missions.

Lead a team of defenders, coordinate cross-functional response, and ensure documentation and compliance with RMF and CSSP requirements in a high-demand, 24/7/365 mission environment.

Qualifications

• Active Top Secret/SCI clearance required.
• DoD 8570/IAT Level II certification within 180 days of hire (e.g., Security+ CE, CySA+, GSEC).
• Minimum 5+ years in SOC/CSSP/Defensive Cyberspace Operations with incident response and threat hunting experience.
• Experience as a senior analyst, shift lead, or escalation point in a SOC or enterprise cyber defense.
• Strong understanding of MITRE ATT&CK, TTPs, and advanced detection techniques.
• Hands-on with SIEM/EDR/SOAR and enterprise monitoring tools (Splunk, Elastic, Defender, Wireshark, Zeek, ServiceNow).
• Ability to coordinate cross-functional response with government stakeholders and partners.

Responsibilities

• Serve as senior analyst and shift lead for monitoring priorities, triage, threat hunting, and incident investigation.
• Coordinate shift-level cyber defense responses during alerts and incidents, escalating as required.
• Validate and prioritize escalated detections from AI-assisted SOC tools and monitoring platforms.
• Lead initial incident triage, containment, remediation, evidence preservation, and reporting.
• Mentor junior analysts in detection analysis and incident response procedures.
• Coordinate with engineers, NetOps, SysOps, and partners to refine detections and playbooks.
• Conduct threat hunting based on TTPs and mission indicators.
• Ensure documentation of incidents and lessons learned per SOPs.

Skills

SOC operations

Threat hunting

Incident response

Communication skills

24/7 support

Tools

Splunk

Elastic

Defender

Wireshark

Zeek

ServiceNow

Job description

Camp HM Smith, HI, USA

Full-time

Clearance Requirement: Top Secret/SCI

Compensation: USD 110290 - USD 148891 - yearly

Company Description

Founded in 1989 and headquartered in Reston, Virginia, SOSi is a private defense and government solutions business specializing in advanced technology systems and mission support. Its capabilities include data science, software development, network engineering, intelligence, surveillance, and reconnaissance (ISR), and logistics.

Job Description

Senior Cyber Defense Analyst Lead

Shape the future of cyber defense at the operational edge. As the Senior Cyber Defense Analyst Lead within SOSi's INDOPACOM Network Security Operations Center, you'll orchestrate next-generation cyber operations across multi-enclave coalition environments powered by advanced DaaS private cloud technologies.

Leveraging AI-enhanced threat detection, real-time analytics, and mission-driven decision-making, you'll lead elite cyber defenders in identifying, disrupting, and neutralizing emerging threats before they impact operations. Working at the intersection of cyber innovation, detection engineering, and mission execution, you'll help safeguard critical warfighter capabilities in one of the world's most dynamic security environments.

Lead the defense. Accelerate the response. Secure the mission.

Essential Job Duties

• Serve as the senior analyst and shift lead for assigned operations, providing direction on monitoring priorities, triage, threat hunting, and incident investigation activities.

• Coordinate shift-level cyber defense response activities during alerts, incidents, outages, and mission-impacting events, escalating to the Incident Response Lead, DCO Lead, or INSOC leadership as required.

• Validate, adjudicate, and prioritize escalated detections from AI-assisted SOC tools, SIEM, EDR, SOAR, and enterprise monitoring platforms.

• Lead initial incident triage and support containment, remediation, evidence preservation, reporting, and handoff activities across shift transitions.

• Mentor junior and mid-level analysts in detection analysis, threat hunting, incident response procedures, documentation standards, and operational best practices.

• Serve as the shift-level liaison between analysts, DCAI engineers, detection engineering, NetOps, SysOps, and mission partners to refine detections, SOAR playbooks, AI-assisted workflows, and response procedures.

• Conduct threat hunting based on adversary tactics, techniques, and procedures (TTPs), threat intelligence, anomaly detection, and mission-specific risk indicators.

• Ensure incidents, investigations, shift notes, case updates, and lessons learned are documented accurately in accordance with SOPs, CSSP reporting requirements, and escalation timelines.

• Support red/blue team events, tabletop exercises, operational drills, and after-action reviews to validate analyst readiness and improve shift procedures.

• Provide clear verbal and written shift updates, incident summaries, and operational reporting to leadership, Government stakeholders, and external mission partners as required.

• Maintain awareness of enterprise cyber, network, system, and mission environments to support timely detection, correlation, and mission-impact assessment.

• Support compliance with RMF, CSSP, DoD 8140, SOPs, and accreditation requirements for AI-augmented cyber defense and incident response processes.

Qualifications

Minimum Requirements

• Active in-scope Top Secret/SCI clearance.

• DoD 8140 / 8570 IAT Level II certification required within 180 days of hire, such as Security+ CE, CySA+, GSEC, CCNA Security, or equivalent.

• Minimum 5+ years of SOC, CSSP, Defensive Cyberspace Operations, or cyber defense experience with demonstrated incident response and threat hunting expertise.

• Experience serving as a senior analyst, shift lead, incident lead, or escalation point within a SOC or enterprise cyber defense environment.

• Strong understanding of adversary TTPs, MITRE ATT&CK, malware analysis fundamentals, cyber kill chain concepts, and advanced detection and response techniques.

• Hands-on experience with SIEM, EDR, SOAR, packet capture and analysis tools, and enterprise monitoring platforms, such as Splunk, Elastic, Defender, Wireshark, Zeek, ServiceNow, or similar tools.

• Ability to coordinate cross-functional response efforts across analysts, engineers, operations teams, Government stakeholders, and mission partners during cyber incidents and operational events.

• Strong written and verbal communication skills, including the ability to brief technical findings, incident status, operational risk, and recommended actions to technical and non-technical audiences.

• Must be flexible to support 24/7/365 operations, including rotating shifts, nights, weekends, holidays, on-call support, and surge coverage during major incidents or exercises.

Preferred Qualifications

• Advanced certifications such as GCIA, GCIH, GDAT, GCTI, CISSP, CASP+, or equivalent.

• Experience supporting DISA, CSSP, TNCC, INDOPACOM, coalition, or military cyber defense environments.

• Prior Tier 2/Tier 3 SOC analyst, shift lead, incident commander, battle captain, or major incident coordination experience.

• Experience working with AI/ML-assisted SOC platforms, automation pipelines, SOAR workflows, and operational analytics platforms.

• Experience building, maturing, or refining SOC workflows, CONOPS, SOPs, escalation procedures, dashboards, and reporting products.

• Experience with Mavin, Power BI, JIRA, ServiceNow, Elastic, Splunk, Microsoft Defender, Zeek, Wireshark, or similar enterprise platforms.

Additional Information

Work Environment

• Shift-based senior analyst role supporting 24/7/365 mission operations; flexibility is required for rotating shifts, weekends, holidays, after-hours escalations, exercises, and surge support.

• Fast-paced, mission-critical cyber defense operations supporting classified mission activities and enterprise-level operational response.

• May require participation in operational meetings, briefings, shift turnovers, tabletop exercises, and after-action reviews.

Working at SOSi

All interested individuals will receive consideration and will not be discriminated against for any reason.

SOSi is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. SOSi takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.