SOC Cyber Analyst

Karthik Consulting, LLC; Port Hueneme (CA); On-site; USD 130,000 - 135,000; Full time

Job summary

Karthik Consulting, LLC is seeking a Security Operations Center (SOC) Cyber Analyst to analyze enterprise networks, OT/ICS, and on‑premises/cloud environments. The role involves malware triage, threat hunting, and acting on security incidents, with reporting to both technical and non-technical audiences.

The analyst will reconstruct attacks using the Cyber Kill Chain, perform host and network forensics, ensure STIG compliance, and collaborate across multiple locations in a DoD-context program.

Qualifications

• Bachelor’s degree in IT or STEM or relevant experience.
• Minimum DoD policy compliance knowledge and security posture.
• Experience with SIEM analytics and incident response practices.
• Familiarity with ICS/OT security concepts and threat hunting.

Responsibilities

• Support SOC monitoring and incident response to maintain a secure environment.
• Develop SIEM analytics and coordinate vulnerability assessments across systems.
• Analyze network activity and logs to identify malicious activity and intrusion methods.

Skills

Analytical thinking

Incident response

Threat hunting

Attack reconstruction

Report writing

Education

Bachelor's degree in IT or STEM

Tools

Palo Alto

Elastic SIEM

Cribl

Splunk

VMware

Security Center

MITRE ATT&CK

Nessus

Endgame

CrowdStrike

GrayNoise

Shodan

BACnet

Modbus

SCADA

Job description

Position Summary:

The Security Operations Center (SOC) Cyber Analyst analyzes technology devices and enterprise networks, including Operational Technology (OT), Industrial Control Systems (ICS), and on-premises and cloud environments. The analyst examines device communications, Windows and Linux forensic artifacts, endpoint activity timelines, authentication and permissions, system logs, and suspicious files. The role supports security monitoring, incident response, malware triage, and threat hunting, reconstructs attacks using the Cyber Kill Chain, and reports actual or potential impacts to technical and non-technical audiences.

Work Environment

• Work Location: On-Site, Point Hueneme, CA Ventura County
• Program: NAVFAC SOC Cyber Analysis
• Security Clearance: Must have Secret and be TS Eligible
• Salary Range: $130K- $135K

Compensation

Karthik Consulting is committed to providing competitive compensation based on the responsibilities of the role, required qualifications, security clearance level, relevant experience, certifications, customer requirements, geographic location, and overall business needs. The salary range listed for this position represents a good-faith estimate of the current compensation range for this role.

At Karthik Consulting, it is not typical for an individual to be hired at or near the top of the salary range. Final compensation decisions are based on the facts and circumstances of each candidate’s experience, qualifications, certifications, clearance level, contract requirements, and overall alignment with the role.

Employees may be eligible for company benefits and additional compensation programs, subject to company policy, contract requirements, and individual eligibility.

Program Mission Scope & Description:

Support a SOC operating across enterprise IT and OT/ICS environments under applicable Department of Defense (DoD) policies and procedures. Work onsite in Point Hueneme, with flexibility based on mission support requirements, and collaborate with personnel across multiple locations.

SIEM monitoring and analytics; host and network analysis; incident response and threat hunting; vulnerability assessment coordination; STIG compliance assessment; asset inventory verification; vulnerability management notifications; evidence collection and handling; security tool integration; and technical reporting.

Key Responsibilities

SOC MONITORING AND INCIDENT RESPONSE

• Support SOC monitoring, incident response, malware analysis, and threat hunting to maintain a secure operating environment.
• Develop and use security information and event management (SIEM) analytics to monitor alerts; coordinate vulnerability assessments and artifact collection across servers and network devices.
• Analyze network traffic and system logs to identify malicious activity, exploited vulnerabilities, and attack methods; improve SOC response processes and efficiency.

HOST FORENSICS AND ATTACK RECONSTRUCTION

• Analyze device communications, Windows and Linux systems and servers, disk and memory artifacts, endpoint timelines, user permissions, and authentication activity.
• Identify and triage malware and suspicious files; apply host-based indicators of compromise (IOCs) to detect known-bad files or endpoint activity.
• Conduct comprehensive technical analysis of computer evidence and reconstruct the attack life cycle using the Cyber Kill Chain, network traffic, and threat intelligence.

SECURITY COMPLIANCE AND ASSET VERIFICATION

• Assess Security Technical Implementation Guide (STIG) compliance and completion; use asset mapping tools to verify connected inventory.
• Handle Information Assurance Vulnerability Management notifications.
• Evaluate network structures and device configurations for security risks, recommend improvements based on best practices, and collect data to identify and respond to intrusions.

TOOLS EVIDENCE AND REPORTING

• Research and integrate security tools into the SOC and provide technical input to hardware and software research, discovery, and implementation.
• Apply logistics and evidence-handling fundamentals when collecting and analyzing computer evidence.
• Synthesize findings into detailed reports for technical and non-technical audiences, explaining attack activity and actual or potential impacts.

Qualifications

Education

Bachelor’s degree in IT and/or STEM field or relevant experience.

Professional Certifications

• Preferred: Certified Ethical Hacker (CEH), GIAC Certified Incident Handler (GCIH), or a relevant IT technology certification.
• Other examples: Offensive Security Certified Professional (OSCP); GIAC Response and Industrial Defense (GRID); CERT Certified Computer Security Incident Handler; GIAC Information Security Fundamentals (GISF); and Certified Information Systems Security Professional (CISSP). Equivalent certifications may also be considered.

Minimum Qualifications

• 3 Experience in security operations, demonstrating analytical duties and preforming host or network security analysis.
• Proficient in analyzing cyber-attacks, with a deep understanding of attack classifications, stages, system/application vulnerabilities, and compliance with Department of Defense (DoD) policies and procedures.
• Applied knowledge of network topologies, protocols (e.g., TCP/IP, ICMP, HTTP/S, DNS, SSH, SMTP, SMB), and experience with tools like Palo Alto, Elastic SIEM, Cribl, Splunk, VMware, Security Center.
• Capable of attack reconstruction based on network traffic, integrating Threat Intelligence, and familiar with MITRE ATT&CK framework, with the ability to collaborate effectively across multiple locations.

Preferred Qualifications

• Proactive self-starter with strong analytical and troubleshooting skills; system administration experience; Windows/Linux OS mechanics and filesystem knowledge; disk/memory forensics; recognition of routine OS/software/user behavior, persistence, privilege escalation, lateral movement, and host-based IOCs.
• OT/ICS knowledge or experience as a cyber-aware control systems operator.
• Splunk Enterprise Security content development using tstats and data models; log review for data model acceleration and existing use cases; correlation rules informed by current threats and attack vectors.
• Experience with Nessus, Endgame, CrowdStrike, GrayNoise, Shodan, BACnet, Modbus, SCADA systems, and PCAP; familiarity with Nessus or Security Center operations and management.