Lead 24x7x365 event monitoring and SOC shift operations for a federal government customer in Washington, DC.

Monitor network traffic for security events and perform triage analysis to identify security incidents.
Respond to computer security incidents by collecting, analyzing, and preserving digital evidence.
Ensure incidents are recorded and tracked in alignment with SOC requirements.
Coordinate with other teams to assess risk and provide recommendations to improve the security posture.
Use technologies for host forensics, Endpoint Detection & Response, log analysis, and network forensics, including a full packet capture solution.
Support root-cause analysis and investigative alerts to examine endpoint activity and network-based data.
Support malware analysis and host and network forensics, including triage and log analysis, for incident response.
Detect attacker and APT activity using tactics, techniques, and procedures as indicators of compromise (IOCs) to improve monitoring and response.
Identify applications and operating systems of network devices based on network traffic.
Reconstruct malicious activity and analyze off-network traffic patterns.
Identify network mapping and operating system fingerprinting activity.
Implement remediation plans with key stakeholders based on incident findings.
Investigate and identify root cause findings, then communicate results to stakeholders, including technical staff and leadership.
Produce end-of-shift reports for documentation and knowledge transfer to incoming analysts.

Bachelor's degree in cybersecurity, information technology, computer science, or related discipline, or an approved experience equivalent.
Minimum three years of general experience and two years of relevant experience under the mapped GSA LCAT.
Five years of qualifying federal cyber defense experience, including incident response, monitoring, forensic analysis, or threat hunting activities.
CSA, CTIA, or contractually accepted equivalent cybersecurity certification.
Experience with SIEM platforms, security alert triage, incident escalation, and operational reporting.
Ability to obtain and maintain the required OCC Public Trust determination.
Ability to work alternating shifts to support operational coverage requirements.
Clear communication skills for management, team members, and clients with varying technical aptitude.
Ability to conduct research and produce security risk assessments/reports when appropriate.
Working knowledge of network protocols: TCP/IP, UDP, SMTP, SSH, etc.
Knowledge of Windows and Linux operating systems.
Good understanding of Intrusion Detection Systems (IDS) and SIEM technologies.
Knowledge of endpoint and network device interoperability (servers, virtual machines, NGFWs, proxies, switches, routers) and understanding of OSI Layer.
Knowledge and experience in cyber threat and intelligence gathering and analysis.
Knowledge of how to read and interpret packet capture (PCAP) and log analysis.

Strong desire to learn and willingness to be challenged.
Passion and a strong foundation in information security concepts.
Minimum of one IAT Level II security industry specific certification (8570 Baseline Certifications), such as CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, or SSCP.
Experience with Splunk, endpoint detection and response technologies, and federal cybersecurity operations.
Prior experience as a SOC shift lead or senior security analyst.

Salary range: USD 101,000 - 115,000 per year (typical range).
Compensation may vary based on education, experience, certifications, and other factors and may fall outside the stated range.

Cybersecurity Event Monitoring (CEM) Shift Lead

Job Description