Tier 2 Security Operations Center (SOC) Analyst

Leidos LLC; Alexandria (VA); On-site; USD 70,000 - 126,000; Full time

Benefits offered by this job

Health and Wellness programs

Paid Leave

Retirement benefits

Job summary

Leidos is seeking experienced Tier 2 Security Operations Center (SOC) Analysts to support the DMDC CyberPRIMES program. The Tier 2 SOC Analyst will perform advanced analysis of cybersecurity events escalated from Tier 1 or identified through enterprise monitoring.

This role requires US citizenship and an active Secret clearance. You will correlate security data, support incident triage and containment, preserve evidence, and coordinate with incident responders to protect government systems in a

Qualifications

• BS degree or equivalent plus 2+ years experience in cybersecurity or SOC.
• Experience analyzing and correlating alerts from multiple monitoring capabilities.
• Experience investigating endpoint, network, or identity-related events.
• US Citizenship and Active Secret clearance required.

Responsibilities

• Perform advanced analysis of cybersecurity events escalated from Tier 1 analysts or identified through endpoint, user-activity, network, and other enterprise monitoring capabilities.
• Correlate alerts, security telemetry, and supporting technical data to determine the nature, scope, severity, and potential impact of cybersecurity activity.
• Distinguish legitimate activity, false positives, policy violations, suspicious behavior, and potential cybersecurity incidents.
• Determine appropriate next actions based on SOC procedures, playbooks, and escalation criteria.
• Support cybersecurity incident triage, escalation, and containment in coordination with the incident-response team.
• Preserve relevant technical evidence and supporting information required for further investigation and incident response.
• Document investigative actions, analysis, findings, and conclusions in Government-approved systems.

Skills

Cybersecurity event analysis

SOC operations

Incident triage

Security monitoring

Documentation

Team collaboration

Education

BS degree or equivalent

Masters with less than 2 years relevant experience

Tools

SIEM platforms

Enterprise security-analysis tools

Security monitoring tools

Job description

Leidos is seeking experienced Tier 2 Security Operations Center (SOC) Analysts to support the Defense Manpower Data Center (DMDC) CyberPRIMES program. Leidos is a major partner on the contract and will provide a substantial portion of the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC. The Tier 2 SOC Analyst will perform advanced analysis of cybersecurity events escalated from Tier 1 or identified through enterprise monitoring capabilities. This position will correlate security data, determine the scope and potential impact of suspicious activity, support incident triage and containment, preserve evidence, and coordinate with incident responders and other cybersecurity teams to protect DHRA systems and networks. Work Locations: Mission Environment DMDC supports the Defense Human Resources Activity within the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)) and maintains the Department of Defense’s largest and most comprehensive central repository of personnel, manpower, casualty, pay, entitlement, personnel security, identity, readiness, training, and related data. The DHRA Information Technology (IT) environment includes approximately 15,000 network and endpoint devices supporting more than 600 Government-Off-The-Shelf (GOTS) applications and approximately 100 Risk Management Framework (RMF) authorization boundaries managed through the Enterprise Mission Assurance Support Service (eMASS). The Tier 2 SOC Analysts operate within a 24x7 security operations environment responsible for detecting, analyzing, escalating, and supporting response to cybersecurity activity affecting DHRA systems and networks. Tier 2 analysts provide the deeper technical analysis required when events cannot be resolved through I Initial Tier 1 triage.

Primary Responsibilities

• Perform advanced analysis of cybersecurity events escalated from Tier 1 analysts or identified through endpoint, user-activity, network, and other enterprise monitoring capabilities.
• Correlate alerts, security telemetry, and supporting technical data to determine the nature, scope, severity, and potential impact of cybersecurity activity.
• Distinguish legitimate activity, false positives, policy violations, suspicious behavior, and potential cybersecurity incidents.
• Determine appropriate next actions based on approved SOC procedures, playbooks, and escalation criteria.
• Recommend or initiate authorized actions to contain or mitigate identified threats.
• Support cybersecurity incident triage, escalation, and containment in coordination with the incident-response team.
• Preserve relevant technical evidence and supporting information required for further investigation and incident response.
• Document investigative actions, analysis, findings, and conclusions in Government-approved systems.
• Maintain complete and accurate event records, tickets, timelines, and supporting evidence.
• Contribute to required SOC event reporting and operational status information.
• Perform Tier 2 troubleshooting of cybersecurity tools, alerts, security data, and related technical issues.
• Use approved Commercial-Off-The-Shelf (COTS) security-analysis tools to investigate cybersecurity events.
• Support security testing, mitigation activities, and cybersecurity compliance checking as required by SOC operations.
• Coordinate analysis with incident responders, network engineers, endpoint-security personnel, cybersecurity-tool teams, system administrators, and other cybersecurity stakeholders.
• Identify recurring false positives, detection gaps, or ineffective alerting and recommend improvements to monitoring and detection capabilities.
• Support tuning of cybersecurity monitoring capabilities to improve detection accuracy and analyst effectiveness.
• Contribute to SOC procedure, playbook, and process improvements based on operational experience and lessons learned.
• Support knowledge transfer across SOC analysts to improve consistent analysis and response within the 24x7 operating environment.

Basic Qualifications

• BS degree or equivalent and 2+ years of prior relevant experience, or a Masters with less than 2 years prior relevant experience.
• In lieu of degree, additional experience may be required.
• Experience performing cybersecurity event analysis, SOC operations, cyber defense, incident triage, or security monitoring.
• Experience analyzing and correlating alerts from multiple cybersecurity monitoring capabilities.
• Experience investigating endpoint, network, user-activity, or other cybersecurity events.
• Experience determining the scope, severity, and potential impact of suspicious cybersecurity activity.
• Experience supporting cybersecurity incident escalation, containment, mitigation, or evidence preservation.
• Experience using enterprise security-analysis or cybersecurity monitoring tools.
• Experience performing Tier 2 cybersecurity troubleshooting.
• Working knowledge of cybersecurity attack techniques, network-security concepts, endpoint security, event analysis, and incident-response processes.
• Ability to document investigations, findings, actions, and conclusions clearly and accurately.
• Ability to work effectively within a team-based 24x7 security operations environment.
• U.S. Citizenship required.
• Active Secret security clearance required.

Preferred Qualifications

• Experience supporting a Department of Defense or Federal Security Operations Center.
• Experience working in a 24x7 SOC or Cybersecurity Service Provider environment.
• Experience with Security Information and Event Management (SIEM) platforms and enterprise cybersecurity monitoring tools.
• Experience analyzing endpoint, network, identity, user-activity, intrusion-detection, or other cybersecurity telemetry.
• Experience supporting cybersecurity incident response and digital-evidence preservation.
• Experience tuning security alerts, detection logic, and monitoring capabilities to reduce false positives and improve detection quality.
• Experience developing or refining SOC procedures, playbooks, or escalation criteria.
• Experience with cybersecurity mitigation, compliance checking, and security testing.
• Experience with cybersecurity mitigation, compliance checking, or denial-of-service etc.
• Experience facing.

Pay Range

Pay Range: Pay Range $69,550.00 - $125,725.00

The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary.

Original Posting

Original Posting: October 9, 2026 For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.

Pay and Benefits

Pay and benefits are fundamental to any career decision.

Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement.

More details are available here.

Securing Your Data

Leidos will never ask you to provide payment-related information at any part of the employment application process. And Leidos will communicate with you only through emails that are sent from a Leidos.com email address. If you receive an email purporting to be from Leidos that asks for payment-related information or any other personal information, please report the email to [e-mail].

Commitment and Diversity

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.