Note: The job is a remote job and is open to candidates in USA. CDM Smith is an employer offering career opportunities in a challenging and progressive work environment. The Senior Cyber Operations Analyst monitors, detects, investigates, and responds to cybersecurity threats and incidents while using automation, AI, and advanced security technologies to improve SOC operations. The role also serves as an escalation point, mentors analysts, develops detection capabilities, and collaborates with security, engineering, data science, and IT teams.
Responsibilities
- Serve as a subject matter expert for a team of analysts supporting managed 24/7/365 monitoring and response operations
- Investigate and respond to cybersecurity incidents, including participating in off-hours and on-call rotations
- Act as an escalation point for day-to-day SOC operations and identify opportunities to automate
- Assess program strengths and weaknesses and recommend AI solutions to improve team skills and knowledge
- Stay current on emerging cybersecurity threats, AI developments, risks and vulnerabilities that may impact services
- Automate repetitive tasks within SOAR environments using Cloud technologies, ML and AI to improve efficiency
- Develop detection capabilities aligned with the MITRE ATT&CK framework and enhance them using automation/AI
- Validate alerts by interpreting confidence scores, risk ratings and recommended actions
- Use NLP tools to analyze events alongside threat intelligence data
- Improve AI model performance and alert tuning by labeling events and validating true and false positives
- Use multiple-agent collaboration using MCP solutions within security workflows
- Collaborate with data science and engineering teams to improve AI models used in SOC operations
- Refine playbooks, policies, procedures and guidelines in alignment with industry best practices and AI capabilities
- Partner with security engineering, incident response and IT teams to improve monitoring, workflows and response processes
- Support the development and tracking of metrics, KPIs and service-level objectives for security events
- Participate in tabletop exercises to identify gaps, improve skills and strengthen communication
- Review reports from tabletop exercises, vulnerability assessments and penetration tests to drive improvements
- Evaluate logging coverage to identify potential gaps in detection capabilities
- Examine log data across endpoints, databases, applications, identity systems, networks, mobile platforms and cloud environments
- Recommend adjustments to security tools to reduce false positives
- Provide guidance on monitoring, logging, identity, data protection and detection strategies, including preventive controls
- Report on SOC performance and posture to cybersecurity leaders and stakeholders as needed
Skills
- * Experience in SOC monitoring and response or related experience
- * Working knowledge of ML and AI, as well as their application in security operations
- * Experience using NLP, query construction and AI-powered tools to analyze logs, threat intelligence and incident data
- * Experience using MCP servers and purpose-built agents to support investigation and response activities
- * Hands-on experience with AI assistants and platforms for investigation, security analysis and response
- * Demonstrated technical understanding of emerging cybersecurity threats, including adversary use of AI
- * Ability to develop detections aligned with the MITRE ATT&CK framework and relevant open-source AI frameworks
- * Proficient in scripting languages such as Python, Bash, JavaScript or PowerShell, as well as experience with KQL
- * Experience with SOAR, SIEM, threat intelligence platforms, identity systems, sandboxes, vulnerability management and EDR/XDR tools
- * Strong understanding of threats, vulnerabilities, and incident response principles
- * Familiar with one or more frameworks or regulations, such as CMMC, NIST CSF, CIS, GDPR, CCPA
- * Strong judgment and ability to make timely decisions in complex situations
- * Experience with Azure, AWS, and GCP. Bonus points for Gov Cloud deployments
- * Experience managing/collaborating with MSSPs
- * Exceptional written and verbal communication skills across multiple levels of the organization
- * Excellent written and verbal communication skills, with the ability to clearly communicate cybersecurity incidents and document post-incident reviews and root cause analyses
- * Strong analytical and problem-solving skills, with the ability to evaluate complex issues and recommend practical solutions
- * Highly organized and efficient, with the ability to manage multiple priorities and meet deadlines in a fast-paced environment
- * Ability to apply both strategic and tactical thinking to support effective security operations and continuous improvement
- * Ability to remain calm and focused under pressure while managing time-sensitive priorities and deadlines
- * Effective decision-making skills in complex and time-sensitive situations
- * Bachelor's degree
- * 6 years of related experience
- * Equivalent additional directly related experience will be considered in lieu of a college degree
- Domestic and/or international travel may be required. The frequency of travel is contingent on specific duties, responsibilities, and the essential functions of the position, which may vary depending on workload and project demands
- No-We will not support sponsorship in the United States, i.e. H-1B or TN Visas for this position
- * One or more GIAC certifications: GCED, GCIH, GDAT, Microsoft Security Operations Analyst Associate
- * Experience managing security information and event management (SIEM) systems, threat intelligence platforms, security automation and orchestration solutions, intrusion detection and prevention systems (IDS/IPS), file integrity monitoring (FIM), data loss prevention (DLP) and other network and system monitoring tools
- * Experience in investigations using formal chain-of-custody methods, forensic tools and best practices
Benefits
- Fully remote or hybrid work options may be considered for successful candidate
- All bonuses at CDM Smith are discretionary and may or may not apply to this position
- Career growth and development opportunities
- Tools and resources to support employees in doing their very best
Company Overview