nTier 2 Security Operations Center (SOC) Analyst

The Tier 2 SOC Analyst will perform advanced analysis of cybersecurity events escalated from Tier 1 or identified through enterprise monitoring capabilities. This position will correlate security data, determine the scope and potential impact of suspicious activity, support incident triage and containment, preserve evidence, and coordinate with incident responders and other cybersecurity teams to protect DHRA systems and networks.

• Experience working in a 24x7 SOC or Cybersecurity Service Provider environment. , * Experience with Security Information and Event Management (SIEM) platforms and enterprise cybersecurity monitoring tools.

n \n \n

• Perform Tier 2 troubleshooting of cybersecurity tools, alerts, security data, and related technical issues.\n

\n \n \n

• Use approved Commercial-Off-The-Shelf (COTS) security-analysis tools to investigate cybersecurity events.\n

\n \n \n

• Support security testing, mitigation activities, and cybersecurity compliance checking as required by SOC operations.\n

\n \n \n

• Coordinate analysis with incident responders, network engineers, endpoint-security personnel, cybersecurity-tool teams, system administrators, and other cybersecurity stakeholders.\n

\n \n \n

• Identify recurring false positives, detection gaps, or ineffective alerting and recommend improvements to monitoring and detection capabilities.\n

\n \n \n

• Support tuning of cybersecurity monitoring capabilities to improve detection accuracy and analyst effectiveness.\n

\n \n \n

• Contribute to SOC procedure, playbook, and process improvements based on operational experience and lessons learned.\n

\n \n \n

• Support knowledge transfer across SOC analysts to improve consistent analysis and response within the 24x7 operating environment.\n

\n \nBasic Qualifications:\n \n \n \n

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline and 5 or more years of relevant cybersecurity experience. Specific experience, education and training may be considered in lieu of degree.\n

\n \n \n

• Experience performing cybersecurity event analysis, SOC operations, cyber defense, incident triage, or security monitoring.\n

\n \n \n

• Experience analyzing and correlating alerts from multiple cybersecurity monitoring capabilities.\n

\n \n \n

• Experience investigating endpoint, network, user-activity, or other cybersecurity events.\n

\n \n \n

• Experience determining the scope, severity, and potential impact of suspicious cybersecurity activity.\n