SOC Analyst

Rishabh RPO; Washington (District of Columbia); On-site; USD 95,000 - 130,000; Full time

Job summary

Rishabh RPO in Washington DC seeks a Tier 3 SOC Analyst to lead advanced incident analysis and remediation for the District government cyber infrastructure. You will oversee a team of SOC Analysts, perform root-cause detection, and coordinate responses with the Incident Response Lead.

Ideal candidate has extensive SIEM/IDS/IPS, threat intel, TCP/IP knowledge, and preferred SANS certifications. This onsite role through 2027 with potential extension offers career growth and critical defense duties.

Qualifications

• Bachelor's degree in cyber security or related field with significant incident handling experience.
• Strong understanding of threats, attacks, and countermeasures across networks and hosts.
• Hands-on with SIEM, IDS/IPS, firewalls, and endpoint protection in enterprise environments.

Responsibilities

• Monitor, detect, analyze, remediate, and report on cyber events for DC infrastructure.
• Escalate incidents to Incident Response Lead and coordinate with SOC team.
• Perform root-cause analysis and trend-based remediation recommendations.
• Tune security tools and reduce false positives through rule adjustments.
• Ingest IOCs/IOAs into security tools to protect government networks.
• Develop SOPs and Runbooks for SOC Analysts.

Skills

Tier 3 SOC Analyst

SIEM

Incident response

Threat intelligence

Log analysis

Network security

TCP/IP

Communication skills

Stress management

Education

Bachelor's Degree in Cyber Security

Undergraduate degree in information technology

SANS GCIA

SANS GCED

SANS GPEN

SANS GCIH

Tools

SIEM

IDS/IPS

Firewalls

DLP

DAM

NAC

Job description

Position Title & Code: Tier 3 SOC Analyst

Location: Washington DC 20003

Project End Date: 09/30/2027 (With Possible extension to next fiscal year)

Description:

• Monitoring, detecting, analyzing, remediating, and reporting on Cyber events and incidents impacting the tech infrastructure of the District of Columbia. Serves as advanced escalation point.
• The SOC Analyst - Tier 3 is cybersecurity technical resource responsible for providing technical analytical oversight a team of SOC Analysts to monitor, detect, analyze, remediate, and report on cybersecurity events and incidents impacting the technology infrastructure of the Government of the District of Columbia. The ideal candidate will have an advanced technical background with significant experience in an enterprise successfully leading a SOC team or unit responsible for analysis and correlation of cybersecurity event, log, and alert data. The candidate will be skilled in understanding, recognition, and root-cause detection of cybersecurity exploits, vulnerabilities, and intrusions in host and network-based systems.

Specific Tasks:

• Utilize advanced technical background and experience in information technology and incident response handling to scrutinize and provide corrective analysis to escalated cybersecurity events from Tier 2 analysts-distinguishing these events from benign activities, and escalating confirmed incidents to the Incident Response Lead.
• Provide in-depth cybersecurity analysis, and trending/correlation of large data-sets such as logs, event data, and alerts from diverse network devices and applications within the enterprise to identify and troubleshoot specific cybersecurity incidents, and make sound technical recommendations that enable expeditious remediation.
• Proactively search through log, network, and system data to find and identify undetected threats.
• Support security tool/application tuning engagements with analysts and engineers to develop/adjust rules and analyze/develop related response procedures, and reduce false-positives from alerting.
• Identify, verify, and ingest indicators of compromise and attack (IOC's, IOA's) (e.g., malicious IPs/URLs, etc.) into network security tools/applications to protect the Government of the District of Columbia network.
• Quality-proof technical advisories and assessments prior to release from SOC.
• Coordinate with and provide expert technical support to enterprise-wide technicians and staff to resolve confirmed incidents.
• Report common and repeat problems, observed via trend analysis, to SOC management and propose process and technical improvements to improve the effectiveness and efficiency of alert notification and incident handling.
• Formulate and coordinate technical best-practice SOPs and Runbooks for SOC Analysts.
• Respond to inbound requests via phone and other electronic means for technical assistance, and resolve problems independently. Coordinate escalations with Incident Response Lead and collaborate with internal technology teams to ensure timely resolution of issues.

Minimum Qualifications:

• Bachelor's Degree in Cyber Security or related area with minimum Five years of demonstrated operational experience as a cybersecurity analyst/engineer handling and coordinating cybersecurity incidents and response in critical environments, and/or equivalent knowledge in areas such as; technical incident handling and analysis, intrusion detection, log analysis, penetration testing, and vulnerability management.
• In-depth understanding of current cybersecurity threats, attacks and countermeasures for adversarial activities such as network probing and scanning, distributed denial of service (DDoS), phishing, ransomware, botnets, command and control (C2) activity, etc.
• In-depth hands-on experience analyzing and responding to security events and incidents with most of the following technologies and/or techniques; leading security information and event management (SIEM) technologies, intrusion detection/prevention systems (IDS/IPS), network- and host-based firewalls, network access control (NAC), data leak protection (DLP), database activity monitoring (DAM), web and email content filtering, vulnerability scanning tools, endpoint protection, secure coding, etc.
• Strong communication, interpersonal, organizational, oral, and customer service skills.
• Strong knowledge of TCP/IP protocols, services, and networking.
• Knowledge of forensic analysis techniques for common operating systems.
• Adept at proactive search, solicitation, and detailed analysis of threat intelligence (e.g., exploits, IOCs, hacking tools, vulnerabilities, threat actor TTPs) derived from open-source resources and external entities, to identify cybersecurity threats and derive countermeasures, not previously ingested into network security tools/applications, to apply to protect the Government of the District of Columbia network.
• Excellent ability to multi-task, prioritize, and manage time and tasks effectively.
• Ability to work effectively in stressful situations.
• Strong attention to detail.

Preferred Education / Certification Requirements:

• Undergraduate degree in computer science, information technology, or related field.
• SANS GCIA, GCED, GPEN, GCIH or similar industry certification desired.

Responsibilities:

• Coordinates IT Project Management, Engineering, Maintenance, QA, and Risk Management.
• Plans, coordinates, and monitors project activities.
• Develops technical applications to support users.
• Develops, implements, maintains and enforces documented standards and procedures for the design, development, installation, modification, and documentation of assigned systems.
• Provides training for system products and procedures.
• Performs application upgrades.
• Performs, monitoring, maintenance, or reporting on real- time databases, real-time network and serial data communications, and real-time graphics and logic applications.
• Troubleshoots problems.
• Ensures project life-cycle is in compliance with district standards and procedures.

Minimum education/certification requirements:

• Bachelor's degree in information technology or related field or equivalent experience.

Skill Assessment: (Please include the years of experience last used and brief description on skills below, information is to be submitted along with the resume)

Skill

Required / Desired

Amount of Experience

Years of Experience

Hands-on operational experience as a cybersecurity analyst/engineer in a security operations center, or equivalent knowledge.

Required

5 Years

In-depth understanding of cybersecurity attack countermeasures for adversarial activities such as malicious code, DDOS, and phishing.

Required

5 Years

In-Depth Hands-On Experience Analyzing And Responding To Security Events And Incidents With Security Information And Event Management System (SIEM)

Required

5 Years

Strong knowledge of cybersecurity attack methodology to include tactics and techniques, and associated countermeasures.

Required

5 Years

Strong Knowledge Of TCP/IP Protocols, Services, Networking, And Experience Identifying, Analyzing, Containing, And Eradicating Cybersecurity Threat

Required

5 Years

11-15 yrs implementing, administering, and operating IS tech such as firewalls, IDS/IPS, SIEM, Antivirus, net traffic analyzers, and malware analysis

Required

11 Years

11-15 yrs utilizing advanced experience with scripting and tool automation such as Perl, PowerShell, Regex

Required

11 Years

11-15 yrs developing, leading and executing information security incident response plans

Required

11 Years

11-15 yrs developing standard and complex IT solutions & services, driven by business requirements and industry standards

Required

11 Years

BS Degree in IT, Cybersecurity, Engineering or equivalent experience

Highly desired