KeenLogic is seeking to hire an Information Security Operation Analyst (SOC Analyst) to join our team. The Information Security Analyst is responsible for designing and implementing solutions for protecting the confidentiality, integrity, and availability of sensitive information.
This is a full-time position offering Fortune 500–level health, dental, and vision benefits, PTO, 401(k), and life insurance. This is an onsite role with a daily schedule from 10:00 AM to 6:00 PM, based in Fairfax, VA.
About the Role
This is a Security Operations Center (SOC) position focused primarily on cybersecurity incident detection and response. Other primary areas of focus include:
- Zero-day events
- Utilizing cybersecurity tools to conduct investigations and analysis of events
- Utilizing the seven steps of the Incident Response process
Personnel assigned to this role will primarily serve on the Operations & Response (O&R) Team and may also support the Vulnerability Assessment and Penetration Test (VAPT) and Engineering teams.
This position also coordinates with the Cybersecurity Services Section and other client divisions, including:
- IT Operations
- Engineering & Integration
- Software Operations
- Office of Investigative Technology
- Must be a U.S. citizen with an active Secret or Top Secret clearance
- Must be eligible for a Top Secret clearance if requested
- Bachelor’s degree from an accredited college or university in one or more of the following disciplines (or equivalent documented formal training):
- Computer Science
- Information Systems
- Engineering
- Business
- Physical Science
- Other technology-related disciplines
- 6+ years of documented work experience performing any combination of:
- Information System Security
- Security Assessment & Authorization
- Cybersecurity
- Computer Forensics
- Insider Threat
- CompTIA CySA+ cybersecurity analyst certification
- Cybersecurity incident response and detection experience
- Experience in cybersecurity event triaging using the seven steps of the Incident Response Process (IRP)
- Security Operations Center (SOC) experience
- Conducting cyber event investigations to determine root cause and identify true/false positives
- Creating rules, thresholds, and policies for cybersecurity tools (IOCs/IOAs)
- Verification and validation, containment, eradication, and recovery from incidents
- Experience validating hashes, malicious IPs, and URLs
- Experience investigating malicious emails and payloads
- Requirements analysis, program development, architecture, engineering, integration, and deployment of IT products in an enterprise environment
- Ability to create and monitor multiple cybersecurity tool dashboards
- Open-source intelligence gathering experience
- Threat hunting and vulnerability assessment experience
- Knowledge of SIEM tools and query generation
- Perform network security monitoring and incident response for a large organization
- Coordinate with other government agencies to record and report incidents
- Maintain records of security monitoring and incident response activities using case management and ticketing technologies
- Monitor SIEM tools to identify security issues for remediation
- Recognize intrusion attempts and compromises through detailed analysis of event data
- Communicate alerts regarding intrusions and compromises to networks, applications, and operating systems
- Assist with implementation of countermeasures or mitigating controls
- Support threat data analysis from classified, proprietary, and open-source resources
- Support Team Lead in developing recommendations for changes to Standard Operating Procedures
- Monitor and review logs and create new security tool signatures
- Perform intrusion detection, log and audit management, vulnerability assessment, compliance management, and security configuration
- Install, configure, troubleshoot, and maintain server configurations (hardware and software)
- Manage accounts, security devices, patches, access control, and passwords
- Analyze collected data to identify vulnerabilities and exploitation potential
- Support development of security countermeasures
- Identify network and OS vulnerabilities and recommend countermeasures
- Support deployment and integration of security tools
- Prepare written reports and provide verbal information security briefings
- Investigate, monitor, analyze, and report on security incidents
- Respond to crisis or urgent situations to mitigate threats
- Apply mitigation, preparedness, response, and recovery approaches
- Provide incident handling support for detection, analysis, coordination, and response
- Actively monitor and remediate unauthorized activities
- Monitor intrusion detection sensors and log collection systems
- Ensure security systems are operating at maximum performance and availability
- Analyze computer security threat information from multiple sources and agencies
Skills Required
- U.S. citizenship
- Active Secret or Top Secret security clearance
- Eligibility for a Top Secret clearance if requested
- Bachelor's degree in Computer Science, Information Systems, Engineering, Business, Physical Science, or another technology-related discipline, or equivalent documented formal training
- 6 or more years of documented experience in information system security, security assessment and authorization, cybersecurity, computer forensics, or insider threat
- CompTIA CySA+ certification
- Cybersecurity incident response and detection experience
- SOC experience
- SIEM tools and query generation knowledge
- Threat hunting and vulnerability assessment experience
- Experience investigating cyber events, determining root cause, and identifying true or false positives
- Experience with incident response processes, including containment, eradication, and recovery
- Experience validating hashes, malicious IP addresses, and URLs
- Experience investigating malicious emails and payloads
- Open-source intelligence gathering experience
- Ability to create and monitor multiple cybersecurity tool dashboards
- Experience creating cybersecurity tool rules, thresholds, policies, indicators of compromise, and indicators of attack
What We Do
Today’s government agencies must continually evolve to keep pace with the dynamic and rapidly changing technology landscape. To ensure continual innovation and improvement, these agencies must be able to anticipate all future needs while embracing technological advancements. At KeenLogic, we create value through differentiation, innovation, and technology to drive high-quality enterprise IT services such as help desk as a service — for government customers. We combine the latest states of “what is” with an unrealized yet needed version of “what could be.” KeenLogic operates two distinct lines of business: (1) Enterprise IT Services (Helpdesk/Service Desk) (2) Network/Internet Services (Fixed-Wireless Microwave Broadband) We have a 10-year track record of high-quality performance and service delivery and a reputation for taking exceptional care of our team. The company is well funded and capitalized to support new project ramp-up and overhead costs, has a highly experienced executive and management team, and a board of directors with over 20 years of management and operations experience. We aim to provide the highest standard of customer service to government agencies by leveraging a corporate foundation that is built on CMMI Level III business processes, leadership, and financial strength. Key attributes: • 10-year history of providing quality, customer-focused IT solutions • Excellent past performance and track record • 95% employee retention rate • Small business agility with large business resources • Secret facility clearance • Well capitalized for project ramp-up • KeenLogic is a reputed enterprise IT services and help desk solutions provider that answers today’s problems while anticipating the needs of tomorrow.
