Senior SOC Analyst — Hybrid (Fairfax) | Incident Response

Everforth, Inc.; Merrifield (VA); Hybrid; USD 110,000 - 170,000; Full time

Job summary

Everforth ECS is seeking a Senior SOC Analyst to stand up and operate the program's Security Operations Center from our Fairfax, VA office in a hybrid capacity.

The role focuses on security monitoring, threat hunting, incident analysis and response, and SIEM development across an unclassified AWS environment, with escalation to cross-functional teams as needed. 8+ years in cybersecurity, including 4+ years in a SOC, and DoD 8140 IAT Level II Security+ or higher are preferred.

Qualifications

• 8+ years of cybersecurity experience, including 4+ years in a SOC environment.
• Active DoD 8140 IAT Level II Security+ (or higher) is preferred.
• Ability to obtain Secret clearance (active preferred).
• Experience with AWS security telemetry (CloudTrail, CloudWatch, GuardDuty).

Responsibilities

• Serve as the primary SOC resource for a new unclassified AWS environment.
• Build, tune, and continuously improve SIEM queries, correlation rules, alerts, dashboards, reports, and detection content.
• Monitor and investigate security alerts, notable events, IoCs, and anomalous activity to determine incidents.
• Own confirmed cybersecurity incidents from detection through closure, ensuring tickets, timelines, findings, response actions, and evidence are complete.
• Coordinate incident response activities with cybersecurity, cloud, network, and system teams and ensure documentation is complete.

Skills

Threat hunting

Incident response

SOC operations

Security monitoring

AWS security telemetry

MITRE ATT&CK

Tools

SIEM development

CloudTrail

CloudWatch

GuardDuty

Windows

Linux

Trellix

Job description

Everforth ECS is seeking a Senior SOC Analyst to stand up and operate the program's Security Operations Center from our Fairfax, VA office in a hybrid capacity.

The role focuses on security monitoring, threat hunting, incident analysis and response, and SIEM development across an unclassified AWS environment, with escalation to cross-functional teams as needed. 8+ years in cybersecurity, including 4+ years in a SOC, and DoD 8140 IAT Level II Security+ or higher are preferred.