SOC Cyber Analyst

Karthik Consulting; Port Hueneme (CA); Sur place; USD 130 000 - 135 000; Plein temps

Résumé du poste

Karthik Consulting, LLC is seeking a SOC Cyber Analyst to support security monitoring, incident response, and threat hunting across IT and OT/ICS environments. You will analyze device communications, Windows and Linux artifacts, and network logs to identify malware, reconstruct intrusions, and report findings.

On-site in Point Hueneme, CA for NAVFAC, with DoD policy compliance and STIG verification. Must have a Secret clearance and TS eligibility.

Qualifications

• Bachelor’s degree in IT or STEM or equivalent experience.
• 3+ years in security operations with host or network analysis.
• Experience with DoD policies and incident handling.
• Knowledge of MITRE ATT&CK framework and attack reconstruction.

Responsabilités

• Support SOC monitoring and incident response to maintain a secure environment.
• Perform host and network analysis to identify malicious activity and artifacts.
• Assess STIG compliance and manage asset inventory and vulnerability notices.
• Compile detailed technical reports for technical and non-technical audiences.

Connaissances

Security operations

Threat hunting

Incident response

Host forensics

Network analysis

Formation

Bachelor's degree in IT or STEM

Outils

Palo Alto

Elastic SIEM

Cribl

Splunk

VMware

Security Center

Description du poste

Position Summary

The Security Operations Center (SOC) Cyber Analyst analyzes technology devices and enterprise networks, including Operational Technology (OT), Industrial Control Systems (ICS), and on-premises and cloud environments. The analyst examines device communications, Windows and Linux forensic artifacts, endpoint activity timelines, authentication and permissions, system logs, and suspicious files. The role supports security monitoring, incident response, malware triage, and threat hunting, reconstructs attacks using the Cyber Kill Chain, and reports actual or potential impacts to technical and non-technical audiences.

• Program: NAVFAC SOC Cyber Analysis
• Security Clearance: Must have Secret and be TS Eligible
• Salary Range: $130K- $135K

Work Environment

• Work Location: On-Site, Point Hueneme, CA Ventura County
• Program: NAVFAC SOC Cyber Analysis
• Security Clearance: Must have Secret and be TS Eligible
• Salary Range: $130K- $135K

Compensation

Karthik Consulting is committed to providing competitive compensation based on the responsibilities of the role, required qualifications, security clearance level, relevant experience, certifications, customer requirements, geographic location, and overall business needs. The salary range listed for this position represents a good-faith estimate of the current compensation range for this role.

At Karthik Consulting, it is not typical for an individual to be hired at or near the top of the salary range. Final compensation decisions are based on the facts and circumstances of each candidate’s experience, qualifications, certifications, clearance level, contract requirements, and overall alignment with the role.

Employees may be eligible for company benefits and additional compensation programs, subject to company policy, contract requirements, and individual eligibility.

Program Mission Scope & Description

Support a SOC operating across enterprise IT and OT/ICS environments under applicable Department of Defense (DoD) policies and procedures. Work onsite in Point Hueneme, with flexibility based on mission support requirements, and collaborate with personnel across multiple locations.

SIEM monitoring and analytics; host and network analysis; incident response and threat hunting; vulnerability assessment coordination; STIG compliance assessment; asset inventory verification; vulnerability management notifications; evidence collection and handling; security tool integration; and technical reporting.

Key Responsibilities

SOC MONITORING AND INCIDENT RESPONSE

• Support SOC monitoring, incident response, malware analysis, and threat hunting to maintain a secure operating environment.
• Develop and use security information and event management (SIEM) analytics to monitor alerts; coordinate vulnerability assessments and artifact collection across servers and network devices.
• Analyze network traffic and system logs to identify malicious activity, exploited vulnerabilities, and attack methods; improve SOC response processes and efficiency.

HOST FORENSICS AND ATTACK RECONSTRUCTION

• Analyze device communications, Windows and Linux systems and servers, disk and memory artifacts, endpoint timelines, user permissions, and authentication activity.
• Identify and triage malware and suspicious files; apply host-based indicators of compromise (IOCs) to detect known-bad files or endpoint activity.
• Conduct comprehensive technical analysis of computer evidence and reconstruct the attack life cycle using the Cyber Kill Chain, network traffic, and threat intelligence.

SECURITY COMPLIANCE AND ASSET VERIFICATION

• Assess Security Technical Implementation Guide (STIG) compliance and completion; use asset mapping tools to verify connected inventory.
• Handle Information Assurance Vulnerability Management notifications.
• Evaluate network structures and device configurations for security risks, recommend improvements based on best practices, and collect data to identify and respond to intrusions.

TOOLS EVIDENCE AND REPORTING

• Research and integrate security tools into the SOC and provide technical input to hardware and software research, discovery, and implementation.
• Apply logistics and evidence-handling fundamentals when collecting and analyzing computer evidence.
• Synthesize findings into detailed reports for technical and non-technical audiences, explaining attack activity and actual or potential impacts.

Qualifications

Education

Bachelor’s degree in IT and/or STEM field or relevant experience.

Professional Certifications

• Preferred: Certified Ethical Hacker (CEH), GIAC Certified Incident Handler (GCIH), or a relevant IT technology certification.
• Other examples: Offensive Security Certified Professional (OSCP); GIAC Response and Industrial Defense (GRID); CERT Certified Computer Security Incident Handler; GIAC Information Security Fundamentals (GISF); and Certified Information Systems Security Professional (CISSP). Equivalent certifications may also be considered.

Minimum Qualifications

• 3 Experience in security operations, demonstrating analytical duties and preforming host or network security analysis.
• Proficient in analyzing cyber-attacks, with a deep understanding of attack classifications, stages, system/application vulnerabilities, and compliance with Department of Defense (DoD) policies and procedures.
• Applied knowledge of network topologies, protocols (e.g., TCP/IP, ICMP, HTTP/S, DNS, SSH, SMTP, SMB), and experience with tools like Palo Alto, Elastic SIEM, Cribl, Splunk, VMware, Security Center.
• Capable of attack reconstruction based on network traffic, integrating Threat Intelligence, and familiar with MITRE ATT&CK framework, with the ability to collaborate effectively across multiple locations.

Preferred Qualifications

• Proactive self-starter with strong analytical and troubleshooting skills; system administration experience; Windows/Linux OS mechanics and filesystem knowledge; disk/memory forensics; recognition of routine OS/software/user behavior, persistence, privilege escalation, lateral movement, and host-based IOCs.
• OT/ICS knowledge or experience as a cyber-aware control systems operator.
• Splunk Enterprise Security content development using tstats and data models; log review for data model acceleration and existing use cases; correlation rules informed by current threats and attack vectors.
• Experience with Nessus, Endgame, CrowdStrike, GrayNoise, Shodan, BACnet, Modbus, SCADA systems, and PCAP; familiarity with Nessus or Security Center operations and management.