SOC Cyber Defense Analyst II — Incident Response Lead

Netrio; McKinney (TX); On-site; USD 85,000 - 110,000; Full time

Job summary

Netrio seeks a mid-level SOC Analyst II to perform deep-dive investigations, lead containment actions, and mentor Tier 1 analysts within a government-focused SOC environment. The role emphasizes DFARS 252.204-7012 workflows and data preservation across DoD-aligned platforms.

You will work with SIEM/XDR and EDR tools, develop detection content, and coordinate with clients per defense industry requirements. US citizenship and background clearance are required.

Qualifications

• 2–5 years of experience in a SOC analyst, incident response, or threat hunting role.
• Experience with at least one SIEM/XDR platform and one EDR platform in a production capacity.
• Solid understanding of the cyber kill chain, MITRE ATT&CK framework, and common adversary TTPs.
• Experience with log analysis, network traffic analysis, and basic malware/artifact triage.
• Strong incident documentation and client communication skills, including under time pressure.
• U.S. Citizenship (required for access to government client environments).
• Ability to pass a background investigation as required by client contracts.

Responsibilities

• Perform in-depth investigation of escalated alerts and incidents using SIEM/XDR and EDR platforms.
• Conduct root-cause analysis, threat correlation, and impact assessment across multi-tenant government client environments.
• Lead containment, eradication, and recovery actions for confirmed incidents per incident response playbooks.
• Own DFARS 252.204-7012 incident reporting workflow, including 72-hour DIBNet reporting coordination and 90-day data preservation requirements.
• Perform threat hunting activities across EDR, SIEM, and identity telemetry (conditional access alerts, sign-in logs).
• Mentor and validate escalations from Tier 1 analysts; provide on-shift coaching and quality review of Tier 1 triage decisions.
• Refine and author detection use cases, correlation rules, and playbooks based on investigation findings.
• Coordinate with client points of contact during active incidents, within defined communication protocols.
• Support endpoint management (RMM) and email security investigations as they intersect with broader incidents.
• Maintain and validate chain-of-custody and evidence-handling procedures for CUI-related investigations under CMMC Level 2 / NIST SP 800-171.
• Participate in tabletop exercises, incident response plan reviews, and audit/assessment support (C3PAO readiness activities).

Skills

SOC analyst

Incident response

Threat hunting

SIEM

EDR

MITRE ATT&CK

Log analysis

Network analysis

Documentation

Communication

Background check

US Citizenship

Tools

SIEM/XDR platform

EDR platform

Job description

Netrio seeks a mid-level SOC Analyst II to perform deep-dive investigations, lead containment actions, and mentor Tier 1 analysts within a government-focused SOC environment. The role emphasizes DFARS 252.204-7012 workflows and data preservation across DoD-aligned platforms.

You will work with SIEM/XDR and EDR tools, develop detection content, and coordinate with clients per defense industry requirements. US citizenship and background clearance are required.