USAF - Security Operations Analyst

cFocus Software Incorporated; Linthicum (MD); On-site; USD 100,000 - 160,000; Full time

Job summary

cFocus Software Incorporated seeks a Security Operations Analyst to support USAF programs in Linthicum Heights, MD. The role requires an active TS/SCI clearance and on-site work. You will monitor security events, investigate alerts, and collaborate across IT and cybersecurity teams to detect and respond to threats.

Responsibilities include threat hunting, data analysis, and maintaining incident records. You will contribute to containment, remediation tracking, and the ongoing improvement of

Qualifications

• Active TS/SCI clearance required.
• B.S. Computer Science, IT, or related field.
• Experience monitoring security events and investigating alerts.
• Ability to correlate telemetry and document findings.
• Knowledge of network protocols, endpoints, access controls, and cyberattack techniques.
• Experience with security monitoring, log analysis, endpoint detection, and vulnerability tools.
• Ability to hunt threats and apply intelligence to investigations.
• Understanding of incident response, evidence handling, and escalation procedures.
• Ability to analyze vulnerabilities and coordinate remediation.
• Strong analytical judgment, collaboration, and writing skills.

Responsibilities

• Monitor and triage security alerts, logs, and events; correlate telemetry to identify threats.
• Analyze security data across networks, endpoints, applications, and cloud environments.
• Conduct data-driven threat hunting to identify advanced threats.
• Investigate anomalous behavior and document evidence, findings, and responses.
• Detect, analyze, and respond to suspected incidents; escalate per procedures.
• Contain, eradicate, and recover from incidents per authorized procedures.
• Maintain incident records, timelines, and evidence.
• Coordinate response with infrastructure, network, app, cloud, and cybersecurity teams.
• Analyze vulnerability findings and coordinate remediation with teams.
• Provide continuous analysis of events and propose improvements.
• Support SOC tools and sensors; address telemetry gaps.
• Coordinate with CSSPs and AFCYBER authorities.

Skills

TS/SCI clearance

Security monitoring

Log analysis

Endpoint detection

Threat hunting

Incident response

Vulnerability analysis

Collaboration & writing

Education

B.S. Computer Science/Information Technology

Tools

Security tools

Job description

cFocus Software seeks a Security Operations Analyst to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.

Qualifications:

• Active TS/SCI clearance
• B.S. Computer Science, Information Technology, or a related field
• Experience monitoring security events, investigating alerts, and supporting enterprise incident response.
• Ability to correlate telemetry, assess anomalies, and document investigation findings.
• Knowledge of network protocols, endpoints, access controls, and cyberattack techniques.
• Experience with security monitoring, log analysis, endpoint detection, and vulnerability tools.
• Ability to hunt threats and apply intelligence to investigations and detection improvements.
• Understanding of incident response, evidence handling, and approved escalation procedures.
• Ability to analyze vulnerabilities and coordinate remediation with technical teams.
• Strong analytical judgment, collaboration, and writing skills for timely investigations

Duties:

• Monitor and triage security alerts, logs, and events; correlate available telemetry to identify suspicious activity and potential threats.
• Analyze network, endpoint, application, and cloud security data within assigned environments to determine event validity, severity, scope, and mission impact.
• Conduct data and intelligence-driven threat hunting to identify hidden or advanced threats in DC3 IT and OT environments.
• Investigate anomalous behavior, distinguish false positives from potential incidents, and document evidence, findings, and recommended responses.
• Detect, analyze, and respond to suspected security incidents; escalates confirmed incidents through established Government-approved procedures.
• Perform assigned containment, eradication, and recovery activities upon incident confirmation, within authorized procedures and access permissions.
• Maintain incident records, timelines, investigation notes, and supporting evidence in accordance with approved handling and documentation procedures.
• Coordinate incident response and recovery with infrastructure, network, application, cloud, and cybersecurity teams; verify assigned corrective actions.
• Analyze vulnerability assessment findings, support risk prioritization and remediation tracking, and coordinate validation with certified assessment specialists.
• Provide continuous analysis of security events and trends; recommend detection improvements and mitigation actions for Government consideration.
• Support operation and maintenance of assigned SOC tools and sensors; identify telemetry gaps and coordinate corrective action with responsible teams.
• Support SOC coordination with Cybersecurity Service Providers (CSSPs), the AFCYBER Operations Center, and applicable higher headquarters authorities.
• Track assigned cyber orders and taskers; coordinate status, required actions, and supporting evidence through approved command and control channels.
• Contribute incident response procedures, lessons learned, security monitoring documentation, and evidence supporting compliance activities.
• Research emerging threats, cybersecurity practices, and technologies; document benefits, risks, and implementation recommendations.