Senior Cybersecurity Analyst

Saic; Washington (District of Columbia); Hybrid; USD 120,000 - 160,000; Full time

Benefits offered by this job

Health insurance

Job summary

SAIC is seeking a Senior Cybersecurity Analyst to support Security Operations and mature offensive security for a critical U.S. Government agency.

You will handle advanced incident detection, investigation, response, threat analysis, and security monitoring across on‑prem and cloud environments. The role includes authorized offensive security activities and validation of vulnerabilities to strengthen controls.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS or related field.
• 5+ years in cybersecurity operations, SOC activities, incident response, or related areas.
• Ability to obtain and maintain a U.S. public trust (citizenship or Green Card).
• Experience investigating and responding to cybersecurity incidents.
• Solid understanding of NIST incident response guidance.
• Experience with network traffic, logs, and threat indicators.
• Experience with SIEM, EDR, threat intelligence platforms.

Responsibilities

• Monitor, analyze, investigate, and respond to cybersecurity alerts using SIEM, EDR, and network tools.
• Perform advanced incident triage to determine scope, impact, and containment steps.
• Analyze logs and telemetry to identify malicious activity and indicators of compromise.
• Lead or support investigations of phishing, malware, insider threats, and data exposure.
• Develop and improve incident response procedures and runbooks.
• Document and track incidents using approved ticketing systems.
• Collaborate with DHS/CISA and vendor advisories affecting systems.
• Provide technical leadership and mentorship to junior analysts.
• Conduct authorized offensive security activities and validate findings.
• Validate vulnerabilities and remediation effectiveness through repeatable testing.
• Test applications, APIs, and identity services with approved assessment tools.
• Distinguish true vulnerabilities from false positives and report findings.
• Develop repeatable testing procedures and technical guidance.
• Work with security operations, patch management, and application teams to improve posture.
• Identify opportunities to enhance monitoring, logging, and controls.
• Research emerging threats to improve capabilities.

Skills

Cybersecurity operations

Incident response

Threat analysis

Security monitoring

Offensive security

Education

Bachelor's degree in Cybersecurity, IT, CS

Tools

SIEM

EDR

Threat intelligence platforms

Privileged access management

Cloud security

Job description

Description

SAIC is looking for a Senior Cybersecurity Analyst supports Security Operations functions while helping establish and mature the organization's offensive security capability in support of a critical U.S. Government agency.

This position is responsible for advanced incident detection, investigation, response, threat analysis, and security monitoring across on-premises and cloud environments. In addition to traditional SOC responsibilities, the analyst performs authorized offensive security activities, including manual vulnerability validation, reproduction of penetration test findings, remediation verification, and security control validation to identify and validate security weaknesses requiring manual analysis beyond automated vulnerability scanning.

The position supports the development of repeatable security validation processes and the agency's evolving offensive security capability, which may expand over time to include application security assessments, adversary emulation, and purple team activities.

ONSITE 3 Days / Remote 2 days – Washington DC

Key Responsibilities

• Monitor, analyze, investigate, and respond to cybersecurity alerts and incidents using SIEM, endpoint detection and response (EDR), network monitoring, email security, identity security, and other enterprise security technologies.


• Perform advanced incident triage to determine scope, impact, attack vectors, and recommend appropriate containment, eradication, recovery, and mitigation activities.


• Analyze network traffic, endpoint telemetry, authentication events, application logs, system logs, and threat intelligence to identify malicious activity and indicators of compromise.


• Lead or support investigations involving phishing, malware, unauthorized access, insider threats, data exposure, and other cybersecurity events.


• Develop, maintain, and improve incident response procedures, investigative workflows, technical documentation, and response playbooks.


• Review, assign, document, and track cybersecurity incidents and operational activities using approved ticketing and documentation systems.


• Support investigations involving DHS, CISA, US-CERT, vendor advisories, and other cybersecurity notifications affecting agency systems.


• Provide technical leadership, mentorship, and knowledge sharing to junior cybersecurity analysts.


• Conduct authorized offensive security activities, including manual vulnerability validation, reproduction of penetration test findings, remediation verification, and security control validation.


• Perform recurring validation testing of known vulnerabilities and security deficiencies to verify exploitability, assess technical impact, and confirm remediation effectiveness.


• Perform manual testing of applications, APIs, identity services, wireless technologies, and other designated systems using approved security assessment tools and methodologies.


• Distinguish confirmed vulnerabilities from false positives, configuration issues, environmental conditions, and non-exploitable findings, and document technical evidence, remediation recommendations, and validation results.


• Develop repeatable testing procedures, validation methodologies, assessment documentation, and technical guidance to support recurring security validation activities.


• Collaborate with Security Operations, Patch and Vulnerability Management, application teams, infrastructure teams, system owners, and external assessors to improve the agency's overall security posture.


• Identify opportunities to improve security monitoring, detection logic, logging, defensive controls, and incident response based on manual security assessment results.


• Research emerging threats, vulnerabilities, and offensive security techniques to support continuous improvement of organizational cybersecurity capabilities.


• Support the continued development of internal offensive security, application security, adversary emulation, and purple team capabilities while performing all activities within approved authorization, scope, rules of engagement, and operational safeguards.

Qualifications

Qualifications & Experience

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field. Additional relevant experience may be substituted in lieu of a degree.


• Five or more years of experience in cybersecurity operations, Security Operations Center (SOC) activities, incident response, vulnerability management, security engineering, or related cybersecurity disciplines.


• Ability to obtain and maintain a public trust requiring U.S. Citizenship or Green Card.


• Demonstrated experience investigating, analyzing, and responding to cybersecurity incidents.


• Strong understanding of cybersecurity principles, attack methodologies, common threat vectors, and NIST incident response guidance.


• Experience analyzing network traffic, endpoint telemetry, authentication activity, application logs, system logs, and threat indicators.


• Experience with enterprise cybersecurity technologies, including SIEM, EDR, email security, identity security, privileged access management, and threat intelligence platforms.


• Working knowledge of TCP/IP, DNS, HTTP/HTTPS, authentication protocols, Windows, Linux, cloud environments, enterprise networking, and common application architectures.


• Understanding of web applications, APIs, authentication, authorization, session management, and common application security vulnerabilities.


• Ability to learn, adapt to, and effectively utilize agency-approved offensive security methodologies, manual security assessment techniques, and supporting technologies.


• Ability to reproduce technical findings, validate vulnerabilities, document repeatable testing procedures, and communicate technical results.


• Strong analytical, troubleshooting, organizational, technical writing, and communication skills.


• Ability to work independently while collaborating effectively across technical teams, application owners, and government stakeholders.

Preferred Qualifications

• Experience conducting manual vulnerability validation, application security testing, remediation verification, or penetration testing activities.


• Experience reproducing and validating findings identified through penetration testing, vulnerability assessments, or independent security assessments.


• Familiarity with OWASP Top 10, OWASP API Security Top 10, MITRE ATT&CK, and common offensive security methodologies.


• Experience evaluating authentication, authorization, business logic, API security, identity security, wireless security, or other application security controls.


• Experience supporting federal cybersecurity operations, FISMA compliance, or DHS/CISA cybersecurity activities.


• Experience developing scripts or automating security tasks using Python, PowerShell, SQL, or similar technologies.


• Relevant cybersecurity certifications such as CISSP, Security+, CySA+, PenTest+, GPEN, GWAPT, GWEB, PNPT, OSCP, or equivalent.

Target salary range: $120,001 - $160,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.