> Markdown version of [/jobs/ext/2721736-cnd-analyst-soc](https://www.wearedevelopers.com/jobs/ext/2721736-cnd-analyst-soc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # CND Analyst - SOC - **Company:** By Light Professional IT Services - **Location:** Falls Church, VA, United States - **Experience:** Experienced - **Salary:** $85,000.0 - $115,000.0 - **Contract:** Permanent contract - **Skills:** Software Applications, User Authentication, Software as a Service, Cyber Security, Information Systems, Intrusion Detection and Prevention, Intrusion Detection Systems, Network Security, Reverse Engineering, Security Information and Event Management, Wide Area Networks, Network Routers, Cyber Threat Analysis, Firewalls (Computer Science), Information Technology, Cyber Warfare, Cisco - **Published:** September 4, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9143000/cnd-analyst-soc ## About the Role * Bachelor's degree required * Willingness to work the required shift of T hursday through Saturday (12-hour shifts) and every other Wednesday (8-hour shift) * Minimum 5 years IT relevent experience and 3 years SOC operations support * Experience managing firewall, IDS/IPS, and router ACL policies * Experience with vulerability management assessment and mitgation * Possess the appropriate DoD 8570 CSSP Analyst, Infrastructure, or Incident Responder certification e.g., CEH, CySA+, CCNA+, SSCP, CGIA. Preferred Experience/Qualifications * Cisco Certification * Palo Alto Certification * Possess an ITIL® v3 or ITIL® 4 Foundation or a higher certification in either category Special Requirements/Security Clearance * Active SECRET DoD clearance or higher ## Description By Light has an opening for a CND Analyst - SOC supporting the Army National Guard (ARNG) in Falls Church, VA. This is an IT Service Management contract in support of the operation, modernization, expansion, and further evolution of the ARNG's global Information Technology (IT) services including networking, compute, storage, infrastructure, applications, hosting, and program management services. The Guard Enterprise Cyber Operations Support (GECOS) program supports the ARNG enterprise IT infrastructure, its Wide Area Network (WAN), authentication and directory services, cybersecurity, application hosting, and associated services. GECOS uses ITIL best practices framework as the basis for IT Service Management (ITSM) model., The ARNG SOC works to monitor enterprise systems, defend against security breaches, and identify, investigate, and mitigate cybersecurity threats. In support of the SOC, the Watch SOC Team staff shall: * Manage the operation of the SOC and the performance of traditional SOC activities on behalf of ARNG 24/7/365 to protect DoD information systems and infrastructure. * Develop a SOC Communications Plan. * Support the RCC-NG in the execution of traditional SOC activities during COOP exercises at a designated COOP site. If it becomes necessary to temporarily relocate SOC operations to a selected alternate site for emergency or test scenarios, support and extend normal SOC operations to that remote location. * Provide technical reports to analyze and summarize the impact of each significant incident and the recovery costs; the capability and effectiveness of Computer Network Defense (CND) sensor coverage and the O&M costs; and the number and categories of threats of concern identified by the SOC and supplied to the SOC by external Government agencies * Author and implement custom detection content (e.g., reports, assets, cases, connectors, customers, dashboards, field sets, files, filters, integration commands, knowledge base, lists, notifications, pattern discovery, query viewers, reports, rules, stages, and users). * Tune the SIEM and IDS/IPS events to minimize false positives. * Analyze and review monitoring SOC metrics. * Evaluate and analyze hardware and software in coordination with and support of the RCC-NG. * Improve processes including developing and refining analysis techniques. * Coordinate and report ISS-related incidents. * Provide support in assembling, evaluating, and monitoring various intrusion detection sensors or tools and associated software applications * Provide DMA support services involving forensic analyses on a variety of digital media devices and mediums to identify, reverse engineer, and de-obfuscate content related to an incident, such as malicious content ## Related Videos - [How Cisco embraced a DevOps culture within its network engineering team](https://www.wearedevelopers.com/videos/99-how-cisco-embraced-a-devops-culture-within-its-network-engineering-team) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Your Infrastructure Is Not a Playground: AI Agents for Infra Done Right](https://www.wearedevelopers.com/videos/2084-your-infrastructure-is-not-a-playground-ai-agents-for-infra-done-right) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Top 6 Hackathons for Developers in 2023](https://www.wearedevelopers.com/magazine/263-top-6-hackathons-for-developers-in-2023) - [System change: restart as developer?](https://www.wearedevelopers.com/magazine/39-system-change-restart-as-developer)