Security Operations

• Provide SOC and Incident Response support, including coordination, execution, and implementation of all actions required for the containment, eradication, and recovery measures for events and incidents
• Monitor and reply to events and alerts from the SIEM, monitoring tools, and other network tools
• Investigate events of interest and escalating to senior NOC / SOC members
• Drive incidents from discovery to closure and reporting, with comprehension of escalation procedures and criteria
• Categorize incidents & events, and partner with appropriate authorities in the production of security incident reports
• Coordinate with other DISA organizations, activities, and other services as appropriate to de-conflict blue / red team activity with open incidents/events
• Build timelines, documents, briefings, and other products as required to inform stakeholders of incident response actions, analysis, and the impact of both adversary activity and blue force response actions
• While not in a period of incident response, conduct continuous exercises and dry runs to improve response outcomes in the event of a cyber-incident
• Provide cybersecurity root-cause analysis in support of any tickets for which it fails to meet the Acceptable Quality Levels (AQLs)
• Investigate compromised endpoints, identifying IOCs within the environment and conveying to users and other teams impact of discovered events.

SOC Analyst

SOC Analyst I

Cyber Operations Analyst

Senior Manager, Regional Security Operations

Staff Portfolio Manager, Cybersecurity Operations