Security Operations

• Provide “eyes on glass” near real-time security monitoring in a 24x7 environment by monitoring security infrastructure and security alarm devices for Indicators of Compromise utilizing a proprietary SIEM and cybersecurity tools;
• Perform near real-time security monitoring of alerts and escalating critical alerts in compliance with the service level agreement;
• Detect security incidents and analyze threats for complex and/or escalated security events;
• Perform level 2 assessment of incoming alerts (assessing the priority of the alert, determining severity of alert in respect to customer environment, correlating additional details) and coordinate with Tier-3 for critical priority incidents, if necessary;
• Perform incident response activities utilizing customer SIEM and cybersecurity toolkits;
• Respond to customer Requests For Information including using Linux command line skills to query raw logs for IOCs, answering questions about the MSS infrastructure, and features of the SIEM including correlation engine while recommending best practices;
• Develop internal and/or external documentation, such as detailed procedures, playbooks, and runbooks; review and assess reports concerning operational metrics;
• Assist with quality control during onboarding of new customers to verify validity of Use Cases and generated alerts;
• Utilize the SOC Knowledge Base and provide input on revisions as needed

Public Sector SOC Analyst

• Join our Cyber Security Operations Center (CSOC)
• Analyze network protocols and infrastructure
• Conduct log investigation and incident handling
• Identify and stop malicious actors targeting Capital One's infrastructure
• Train and mentor teammates

Cyber Security Operations Center Analyst

• Actively monitor and respond to cybersecurity incidents related to alerted policy violations
• Analyze and investigate incidents to determine their nature and scope.
• Coordinate with the lead and other Cybersecurity Incident Response Teams for effective incident resolution.
• Document incidents and response activities in detail.
• Stay updated with the latest cybersecurity threats and trends.
• Assist in developing and refining incident response strategies and procedures.
• Collaborate with operations teams, legal, human resources and management to investigate security issues and interview investigation subjects to determine true and false positives.

Cybersecurity Incident Response Triage Analyst

• Manage incident triage and coordination with analysis and detection sections
• Identify and analyze technology and cyber impacts to IT assets, network infrastructure (LAN/WAN)
• Direct continuity of operations for emergency relocation of 24x7x365 operations
• Organize, support, and manage the containment, investigation, and remediation efforts regarding incidents
• Perform quality assurance of service desk actions and Remedy ticket submissions
• Monitor, respond, and catalog SOC and SIM emails as applicable
• Submit Remedy tickets as necessary to assist with keeping the triage console free of backlogs
• Support incident response engagements and maintain understanding of threats, vulnerabilities, and exploits

SOC Operations Analyst – Public Trust

• Manage incident triage and coordination with analysis and detection sections to identify and analyze technology and cyber impacts to IT assets, network infrastructure (LAN/WAN), including applying security and ensure proper incident management and coordination.
• Direct continuity of operations for emergency relocation of 24x7x365 operations to include uninterrupted telecommunications, computer systems, cybersecurity, and networks.
• Organizes, supports, and manages the containment, investigation, and remediation efforts in regards to incidences.
• Perform quality assurance of service desk actions and Remedy ticket submissions.
• Monitor, respond, and catalog SOC and SIM emails as applicable.
• Submit Remedy tickets as necessary to assist with keeping the triage console free of backlogs.
• Supports incident response engagements, and partners with other incident response teams in maintaining an understanding of threats, vulnerabilities, and exploits that could impact client networks and assets.
• Monitor and review multiple data sources, including intelligence, media, and law enforcement reporting, to identify cybersecurity incidents, threats, and vulnerabilities.
• Provide classified and unclassified cyber risk briefings and activity updates, to include but not limited to civilian government agencies and community stakeholders.
• May be required to coordinate with external organizations, authorities, and senior level leadership.

Senior SOC Operations Analyst – Public Trust

• Provide day-to-day technical oversight, coordination, and guidance to contractor personnel performing operational cybersecurity and threat intelligence functions.
• Lead all activities supporting the National Cybersecurity Operations (NCO) mission including threat intelligence collection and analysis, threat hunting, and incident response coordination.
• Monitor and analyze cyber threat intelligence relevant to FAA and NAS systems.
• Produce actionable intelligence products that inform assessment priorities and defensive posture decisions.
• Coordinate incident response activities when potential security events are identified.
• Ensure response actions follow established procedures and are documented.
• Attend all Program Management Reviews with the Program Manager and report on NCO operational support activities, threat intelligence findings, deliverables, and technical issues.
• Maintain awareness of emerging cyber threats targeting critical infrastructure, aviation systems, and government networks.
• Brief FAA leadership on threat trends and recommended defensive actions.
• Collaborate with the Security Assessment Lead and Penetration Testing Lead to ensure assessment and testing priorities reflect the current threat landscape.
• Develop and maintain standard operating procedures for NCO functions including escalation criteria, reporting templates, and coordination protocols.
• Manage and oversee contractor staff performing NCO functions.
• Ensure personnel maintain required qualifications and training.

NCO Technical Lead

• Lead vulnerability management and secure configuration operations, ensuring alignment with federal cybersecurity mandates.
• Manage, monitor, and report vulnerabilities across NIH/HHS systems using tools such as Invicti and coordinate timely remediation activities.
• Develop vulnerability prioritization models based on risk, exposure, and asset criticality.
• Develop secure configuration baselines and monitoring processes based on CIS Benchmarks.
• Ensure compliance with patching timelines and federal vulnerability directives.
• Collaborate with infrastructure, application, and security teams to validate remediation actions.
• Support preparation of reports for leadership and federal oversight bodies.
• Develop KPI metrics for vulnerability and compliance gap closure rates, asset risk scoring, and compliance tracking.

Cybersecurity Operations Consultant

• Lead a team of professionals using cyberspace capabilities to evaluate potential weaknesses
• Assist in developing strategies, doctrine, policies, directives, and instructions
• Make recommendations to ensure compliance to support full-spectrum Cyberspace Operations
• Provide domain and functional subject matter input to briefings
• Transition concepts to execution
• Assist in the coordination of operational planning in support of training, exercises, combat, and contingency plans and operations
• Use research and analysis expertise to assess and inform operators and senior leadership on dynamic tactics, techniques, and procedures for the Army

Security Operations jobs in Virginia

See all jobs on JobTailor