SOC Cyber Analyst: Threat Detection & Incident Response

Arcfield; Newport (RI); Hybrid; USD 64,000 - 112,000; Full time

Benefits offered by this job

Health Insurance

Life Insurance

Paid Time Off

Holiday Pay

Short Term and Long-Term Disability

Retirement and Savings

Learning and Development opportunities

wellness programs

other optional benefit elections

Job summary

Arcfield seeks a Cyber-Intelligence Analyst II to monitor security events using Splunk and Airlock Digital, investigate alerts, and support threat detection and incident response. The role requires strong SOC experience, knowledge of SIEM/XDR tools, AD and Windows Server administration, and compliance with security standards.

A DoD security clearance is required. Responsibilities include engineering detection analytics, identifying gaps, and collaborating with ISSOs and engineers to resolve

Qualifications

• 6+ years experience in Security Operations Center processes and using SIEM and XDR tools.
• Understand and respond to security detections in a SIEM adhering to Incident Response Processes.
• Strong background in Security Compliance & Vulnerability Management.
• Experience deploying enterprise tools on Domain Computers, including Antivirus and endpoint protection and vulnerability scanning.
• Proficient in Active Directory (AD) & Domain Controller (DC) Administration.
• Knowledge of Windows Server Administration and CIS/DISA STIG baselines.
• CompTIA Security+ CE.
• Active Secret DoD Security Clearance required for this role.

Responsibilities

• Monitor and analyze security events in Splunk and Airlock Digital. Analyst on Duty: Investigate alerts that are triggered in the Splunk Console to determine if a threat or normal activity is allowed in the environment.
• Provide threat detection and incident response to mitigate risks to the Network
• Security Detection Engineering: troubleshoot, improve and develop security detection analytics. able to determine detection gaps and draft analytics to correct them
• Interpreting activity to determine what is malicious vs expected across Windows/Linux workstations and servers, Firewall, Switch, Router, Endpoint Security, Wireless IDS, and other logs; proficiency in scripting languages (PowerShell, Python, Bash)

Skills

Scripting languages

Incident response

Threat detection

Education

Bachelor's degree

Master's degree

Tools

SIEM/XDR tools

Active Directory

Windows Server

Endpoint protection

Vulnerability scanning

Job description

Arcfield seeks a Cyber-Intelligence Analyst II to monitor security events using Splunk and Airlock Digital, investigate alerts, and support threat detection and incident response. The role requires strong SOC experience, knowledge of SIEM/XDR tools, AD and Windows Server administration, and compliance with security standards.

A DoD security clearance is required. Responsibilities include engineering detection analytics, identifying gaps, and collaborating with ISSOs and engineers to resolve