Senior SOC Analyst/Lead

ECS; Virginia; Remote; USD 135,000 - 150,000; Full time

Job summary

ECS Federal LLC is seeking a Senior SOC Analyst (SOC Lead) to work remotely in a mature 24x7 SOC. You will help ingest, correlate, and analyze IoCs, lead incident escalations, and develop processes, SOPs, playbooks to improve detection and response.

The role requires leadership, mentoring, and strong communication with executives and SOC teams, with experience using SIEM tools (QRadar, Splunk) and EDR (CrowdStrike). Salary range is $135k-$150k with opportunity for growth.

Qualifications

• 5+ years in cybersecurity operations & incident response, with leadership experience
• Ability to interpret complex topics and present to executives/SOC
• Deep knowledge of SIEM/EDR technologies and vulnerability management
• Experience mentoring junior analysts and leading investigations
• Certifications such as CISSP, CISM, GIAC, CEH preferred

Responsibilities

• Monitor and manage threats, disseminate information, and handle incident escalations from SOC
• Track and document security incidents; maintain incident tickets and SOPs
• Continuously monitor SIEM/on-premises/cloud for threats and intrusions
• Coordinate with SOC staff for investigations and IoC remediation
• Lead root-cause analyses and post-mortems to drive improvements
• Develop runbooks, SOPs, and playbooks to support incident response
• Provide training and mentorship to SOC analysts

Skills

SOC leadership

Incident response

Analytical skills

Threat monitoring

Communication

Mentorship

SLA management

Team collaboration

Calm under pressure

Automation & playbooks

Education

Bachelor's degree in cybersecurity or related field

Tools

QRadar

Splunk

CrowdStrike

Tenable

Job description

Job Description

ECS is seeking a Senior SOC Analyst/Lead to work remotely.

Position Summary

ECS is seeking a Senior SOC Analyst (SOC Lead) with demonstrated experience supporting the development of processes, procedures, and automations to rapidly ingest, aggregate, correlate, normalize, analyze event messages to absurdly identify and respond to Indicators of Compromise (IoCs). The ideal candidate is a critical thinker and perpetual learner who is excited to solve some of our clients’ toughest challenges. To be successful the candidate must have experience working in a mature 24x7x365 Security Operation Center. Shift schedule: Mon-Friday, 8AM-4PM ET (subject to change)

Responsibilities

• Provides subject matter expertise for monitoring and managing threats, disseminating information, and handling, responding to, and investigating all incident escalations from the Security Operations Center.
• Ensures all security incidents are tracked and documented appropriately.
• Continuously monitors SIEM and on-premises infrastructure/cloud applications for security events to threats & intrusions, including:
• SIEM alert queue
• Phishing email inbox
• Intel feeds via email and other sources (i.e., US-CERT, MS-ISAC)
• Incident ticketing queue (Resilient tickets)
• Ensures the SOC manager stays informed of any issues or incidents.
• Coordinates with SOC staff to conduct incident/policy violation investigations, report infractions, eradicate/mitigate/remediate Indications of Compromise (IoC), and perform continuous monitoring functions.
• Leads root cause analysis and post-mortem dialogue after significant events to capture lessons learned and define process or technology improvements.
• Owns the successful completion of all daily operational processes and procedures.
• Develops and maintains standard operating procedures (SOPs), technical playbooks and operational run books to support SOC operations and incident response activities.
• Conduct follow-up meetings of escalated or noteworthy cases and modifies SOPs and playbooks based on policies, standards and best practices learned from previous cases.
• Works in conjunction with SOC and infrastructure management teams to administer and manage the SOC security technologies.
• Evaluates Common Vulnerabilities and Exposures (CVE) as a potential internal/external attach vector, develop recommendations to eliminate vulnerability/weakness if present.
• Work closely with Cyber Threat Intel to provide information on detection patterns for new upcoming threats.
• Oversees threat hunting initiatives and reviews hunt reports that are provided by SOC analysts. Provides training and mentorship to SOC analyst to improve the incident handling capabilities.
• Provides guidance for all internal stakeholders for reporting and visualizations that supports SOC goals and objectives to identify and correct gaps.
• Reconfigures analytic objects (e.g., fields, extractions, tags, event types, lookups, workflow actions, aliases).
• Develops reports for operational activities to meet SOC and cybersecurity leadership requirements and directives.
• Provides extensive knowledge of cybersecurity, incident response, digital forensic analysis and educate personnel on effective SOC searches, reporting, and visualization development.

This role involves shift work schedule to support our 24/7 operation, including weekends and holidays. Candidates must be flexible in their availability. While we make every effort to accommodate individual preferences, it's essential to understand that specific shift requests are not guaranteed and are assigned based on operational needs.

Salary Range: $135,000 - $150,000

General Description Of Benefits

Required Skills

• Bachelor's degree in cybersecurity or related field.
• 5+ years of experience in cybersecurity operations & incident response, with at least 3+ years in a SOC environment and 2+ years in a leadership role
• Ability to interpret complex cybersecurity topics and effectively communicate or present information to various groups of stakeholders (Executives, SOC, etc.)
• In-depth knowledge of SIEM technologies (i.e. QRadar, Splunk), EDR (i.e. CrowdStrike), IDS/IPS, malware analysis, and vulnerability management tools (i.e.Tenable).
• Experiencing leading and mentoring junior analysts
• Experience with two or more analysis tools used in a CIRT or similar investigative environment.
• Ability to analyze and triage IoCs.
• Proven understanding of computer and network fundamentals
• Ability to perform in-depth research tasks and produce written summaries to include insights and predictions based on an analytical process.
• Knowledge of current cyber threats, trends, attack lifecycle, and various Tactics, Techniques, and Procedures (TTPs)
• Industry-recognized certifications, such as CISSP, CISM, GIAC, or CEH, are preferred
• Excellent leadership, written and oral communication skills, and problem-solving skills
• Ability to handle high-stress situations with a calm and methodical approach

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

Everforth ECS is the federal segment of Everforth, a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies. Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

We Value

• Attracting and developing top talent and high-performing teams
• Fostering a culture that is engaging, accountable, and mission-driven

Desired Skills

• Experience collecting, analyzing, and categorizing threat intelligence data from multiple sources to author actionable intelligence reports
• Deep understanding of computer architecture, operating systems, vulnerabilities, encryption, or other advanced areas of expertise
• Proven ability to drive incidents to conclusions based on SLA and severity ratings.
• Experience in threat hunting, forensics, or malware analysis.
• Knowledge of advanced persistent threats (APTs) and modern attack techniques.
• Proficiency with security automation (SOAR), orchestration, and scripting (Python, PowerShell, etc.) to enhance SOC operations & threat intelligence.

Meet the challenge. Make a difference with Everforth ECS!