Note: The job is a remote job and is open to candidates in USA. SAIC is hiring a Cybersecurity Ops Analyst for its 24/7/365 Enterprise Security Operations Center Detection & Response team. The role analyzes and responds to security events using SIEM and EDR tools, investigates incidents, and contributes to threat hunting and continuous improvement of detection capabilities and response procedures.
Responsibilities
- Independently monitor, triage, and investigate security alerts and anomalous activity, determining severity, scope, potential impact, and appropriate response actions
- Perform in-depth security investigations by analyzing and correlating network, endpoint, system, and cloud telemetry using SIEM and EDR technologies. Evaluate suspicious activity, threat intelligence, and vulnerability information to identify potential threats and assess organizational risk
- Execute approved response actions, including IP/URL/Hash blocks, endpoint isolation, and escalate confirmed or suspected incidents to appropriate incident response teams
- Participate in proactive threat hunting activities to identify suspicious behavior, indicators of compromise and potential detection gaps
- Document investigations, findings, supporting evidence, and response actions accurately and consistently in the incident tracking system
- Contribute to SOC continuous improvement through detection tuning recommendations, process enhancements, and updates to procedures and documentations
- Support the onboarding and training of new analysts through knowledge sharing, cross-training, and technical assistance
Skills
- Bachelor's degree and 2+ years of experience or an Associate's degree in related discipline and 3+ years or more experience. An additional 4+ years of experience may be considered in lieu of a degree
- Must be a US Citizen
- Must have a minimum 2 years of cybersecurity operations related experience
- Must possess the following certification(s): Security+ AND CySA+
- Hands-on experience with SIEM and EDR technologies, including security alert investigation, endpoint analysis, and correlation of security events
- Experience triaging security incidents, assessing severity and potential impact, and determining appropriate escalation procedures
- Working knowledge of network security fundamentals and identification of suspicious network activity
- Working knowledge of Windows, Linux, and cloud environments, including relevant security logs, events and telemetry
- Understanding of common attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CK framework and its application to security investigations
- Ability to independently investigate complex or unfamiliar security events, exercise sound technical judgment, and communicate investigative findings
- Strong written and verbal communication skills, including the ability to clearly document investigations and coordinate with technical and nontechnical stakeholders
- Ability to effectively share technical knowledge and provide guidance to less experienced analysts
- Hands-on experience with Splunk Enterprise Security (ES)
- Experience participating in the full incident response lifecycles, including containment, eradication, recovery and post-incident analysis
- Experience conducting proactive threat hunts, identifying detection gaps, and contributing to detection tuning and improvements
- Familiarity with scripting or automation using Python, PowerShell, or similar technologies to support security investigations and operational efficiency
Benefits
- Remote work anywhere in the United States
Company Overview