SOC Analyst

Intone Inc; Washington (District of Columbia); Hybrid; USD 100,000 - 140,000; Full time

Job summary

Intone Inc. is seeking a SOC Analyst – Tier 3 for a 6‑month contract based in Washington, DC. The candidate will lead analytical oversight of a SOC team, monitor and report on cybersecurity events, and guide incident response with advanced technical expertise.

The role requires extensive experience in SOC operations, incident response, SIEM analysis, and network security, with a proven ability to develop SOPs and runbooks for efficient incident handling.

Qualifications

• 5+ years hands‑on operational experience in a security operations center or equivalent.
• 5+ years in-depth understanding of cyber attack countermeasures including adversarial activities such as malware, DDoS, phishing.
• 5+ years hands‑on experience with SIEM for security events and incidents.
• 11–15 years implementing and operating information security tech like firewalls, IDS/IPS, SIEM, antivirus.
• 11–15 years scripting and automation experience using Perl, PowerShell, and Regex.

Responsibilities

• Audit and analyze escalated SOC events from Tier 2 analysts to confirm incidents.
• Correlate logs and alerts from diverse devices to identify incidents and remediation steps.
• Search logs and network data to uncover undetected threats.
• Tune security tools and create/adjust runbooks for SOC analysts.
• Ingest IOCs/IOAs into security tools and assist with containment and remediation.

Skills

SOC operations

Incident response

SIEM analysis

Network protocols

Scripting

Education

Bachelor's degree in IT/Cybersecurity/Engineering

Tools

Perl

PowerShell

Regex

Job description

This is a 6-month contract position for a SOC Analyst – Tier 3 based in Washington, District of Columbia. The role is a cybersecurity technical resource responsible for providing technical analytical oversight to a team of SOC Analysts. You will monitor, detect, analyze, remediate, and report on cybersecurity events and incidents impacting the technology infrastructure. The ideal candidate will have an advanced technical background with significant experience leading a SOC team or unit responsible for analysis and correlation of cybersecurity event, log, and alert data, and will be skilled in understanding, recognition, and root-cause detection of cybersecurity exploits, vulnerabilities, and intrusions in host and network-based systems.

Responsibilities

• Utilize advanced technical background and experience in information technology and incident response handling to scrutinize and provide corrective analysis to escalated cybersecurity events from Tier 2 analysts, distinguishing these events from benign activities and escalating confirmed incidents to the Incident Response Lead.
• Provide in-depth cybersecurity analysis and trending/correlation of large datasets such as logs, event data, and alerts from diverse network devices and applications within the enterprise to identify and troubleshoot specific cybersecurity incidents and make sound technical recommendations that enable expeditious remediation.
• Proactively search through log, network, and system data to find and identify undetected threats.
• Support security tool and application tuning engagements with analysts and engineers to develop and adjust rules, analyze and develop related response procedures, and reduce false-positives from alerting.
• Identify, verify, and ingest indicators of compromise and attack (IOCs, IOAs) such as malicious IPs and URLs into network security tools and applications.
• Quality-proof technical advisories and assessments prior to release from SOC.
• Coordinate with and provide expert technical support to enterprise-wide technicians and staff to resolve confirmed incidents.
• Report common and repeat problems observed via trend analysis to SOC management and propose process and technical improvements to improve the effectiveness and efficiency of alert notification and incident handling.
• Formulate and coordinate technical best-practice SOPs and Runbooks for SOC Analysts.
• Respond to inbound requests via phone and other electronic means for technical assistance and resolve problems independently. Coordinate escalations with Incident Response Lead and collaborate with internal technology teams to ensure timely resolution of issues.

Qualifications

• Required

  • 5+ years hands‑on operational experience as a cybersecurity analyst or engineer in a security operations center, or equivalent knowledge.
  • 5+ years in-depth understanding of cybersecurity attack countermeasures for adversarial activities such as malicious code, DDoS, and phishing.
  • 5+ years in-depth hands‑on experience analyzing and responding to security events and incidents with Security Information and Event Management System (SIEM).
  • 5+ years strong knowledge of cybersecurity attack methodology to include tactics, techniques, and associated countermeasures.
  • 5+ years strong knowledge of TCP/IP protocols, services, networking, and experience identifying, analyzing, containing, and eradicating cybersecurity threats.
  • 11–15 years implementing, administering, and operating information security technology such as firewalls, IDS/IPS, SIEM, Antivirus, network traffic analyzers, and malware analysis.
  • 11–15 years utilizing advanced experience with scripting and tool automation such as Perl, PowerShell, and Regex.
  • 11–15 years developing, leading, and executing information security incident response plans.
  • 11–15 years developing standard and complex IT solutions and services, driven by business requirements and industry standards.

• Preferred

  • Bachelor's degree in IT, Cybersecurity, Engineering, or equivalent experience.