> Markdown version of [/jobs/ext/1275540-cyber-defense-incident-responder-soc-analyst](https://www.wearedevelopers.com/jobs/ext/1275540-cyber-defense-incident-responder-soc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Defense & Incident Responder (SOC Analyst)

- **Company:** Gormat, LLC
- **Location:** Arlington, VA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Information Systems, Event Logging, Intrusion Detection and Prevention, Intrusion Detection Systems, Log Analysis, Security Information and Event Management, Information Technology, Purple Team (Cyber Security), Cyber Warfare
- **Published:** July 15, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9030951/cyber-defense-incident-responder-soc-analyst

## About the Role

Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Computer Science, Data Science, or related field from an ABET accredited or CAE designated institution preferred
*
Minimum of 6 years of experience in Information Technology and/or Information Security
*
Experience with incident response, threat analysis, SIEM platforms, endpoint security tools, and log analysis
*
Strong analytical and investigative skills with the ability to derive accurate conclusions during incident investigations
*
Active Secret clearance or higher required
*
Must be eligible to obtain a Top Secret clearance if requested
*
Ability to successfully complete a DEA background investigation
*
Must possess at least one applicable DoD 8140 certification or obtain certification within 6 months of onboarding

## Description

The Cyber Defense & Incident Responder is responsible for monitoring, analyzing, and responding to cybersecurity incidents in accordance with established procedures. This role focuses on incident triage, investigation, containment, and recovery to minimize impact and restore normal operations.

The analyst will leverage security tools, event logs, correlation data, and threat intelligence to determine the nature and scope of incidents, document findings, and recommend remediation steps., *
Monitor enterprise security systems and analyze alerts to identify potential cybersecurity incidents
*
Review SIEM, IDS/IPS, EDR, and related tool alerts for anomalous activity and indicators of compromise
*
Validate alerts, reduce false positives, and prioritize incidents based on severity and impact
*
Perform triage and analysis of security events to determine scope, severity, and urgency
*
Examine log data, network telemetry, and endpoint information to identify malicious activity
*
Correlate event details with internal and external threat intelligence
*
Execute incident response actions in accordance with established procedures
*
Contain affected systems, remove malicious artifacts, and assist with system recovery
*
Escalate complex or critical incidents to senior analysts or SOC leadership as needed
*
Document investigative findings, incident timelines, and remediation actions
*
Create and manage incident tickets and upload supporting evidence and artifacts
*
Contribute to after action reviews and post incident reporting
*
Communicate findings clearly and concisely to technical and nontechnical stakeholders
*
Maintain SOC processes, tools, and playbooks to support effective incident handling
*
Recommend improvements to SOPs, escalation procedures, and detection capabilities
*
Participate in training exercises and knowledge sharing activities
*
Support red, blue, or purple team exercises as directed
*
Stay informed on current and emerging cyber threats, threat actor TTPs, and industry trends


## Related Videos

- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Is your backend a hodgepodge of queues, event stores and cron jobs? Durable Execution to the Rescue.](https://www.wearedevelopers.com/videos/744-is-your-backend-a-hodgepodge-of-queues-event-stores-and-cron-jobs-durable-execution-to-the-rescue)
- [Progressive Delivery in Kubernetes](https://www.wearedevelopers.com/videos/949-progressive-delivery-in-kubernetes)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Kafka Streams Microservices](https://www.wearedevelopers.com/videos/168-kafka-streams-microservices)
- [Leveraging Large Language Models for Legacy Code Translation: Challenges and Solutions](https://www.wearedevelopers.com/videos/1157-leveraging-large-language-models-for-legacy-code-translation-challenges-and-solutions)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTF](https://www.wearedevelopers.com/magazine/728-dev-digest-216-cybersec-mythos-stack-overflow-for-agents-doom-in-ttf)
- [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)