> Markdown version of [/jobs/ext/3255645-senior-cyber-defense-analyst-with-secret-clearance](https://www.wearedevelopers.com/jobs/ext/3255645-senior-cyber-defense-analyst-with-secret-clearance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Cyber Defense Analyst with Secret Clearance

- **Company:** CALNET INC
- **Location:** Fort Bragg, NC, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Data Analysis, Big Data, Configuration Management, Computer Networks, Intrusion Detection Systems, Network Security, Pcap, Network Configuration and Change Management, NetFlow, Packet Analyzer, Reverse Proxy, Security Information and Event Management, Snort (Software), SC Clearance, Information Technology, Cyber Warfare
- **Published:** September 9, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9150901/senior-cyber-defense-analyst-with-secret-clearance

## About the Role

* Network Security Monitoring and Event Analysis., * Bachelor's Degree in an IT field preferred
 * U.S Citizenship and Secret Clearance is required.
 * 5+ years' IT Infrastructure experience

## Description

+ Conduct continuous monitoring using the enterprise SIEM platform (currently Elastic SIEM, or successor as designated by the Government) and supporting big-data analytics and detection tooling.
 + Analyze and correlate anomalous events across SIEM, host-based security (Trellix ENS or successor), endpoint detection (Tychon or successor), full packet capture (PCAP), NetFlow, IDS/IPS (Snort, Suricata, Sourcefire, Fidelis, Zeek), forward and reverse proxy logs, router/firewall syslog, and JRSS-equivalent boundary devices.
 + Perform exploratory and in-depth analysis of host-based audit logs, captured network traffic, malware artifacts, and incident report trends to characterize threats and identify Advanced Persistent Threat (APT) activity not detected via traditional means.
 + Develop, document, and refine a definable, repeatable triage process and support analytic scripts to enable consistent escalation across the analyst team.
 + Maintain and update SIEM correlation rules, watchlists, and detection logic, and coordinate signature submissions with ARCYBER signature working groups for global implementation where appropriate.

 * Incident Response and Internal Defensive Measures (IDM).

 * Execute critical blocks within two (2) hours of notification or detection (or as otherwise determined by event criticality) to mitigate ongoing threat activity within the AOR.
 * Execute immediate (within 24 hours) action steps to mitigate threats where the operational impact of delay would exceed acceptable risk.
 * Coordinate with the applicable Theater Signal Command (TSC), DoDIN-A staff, and supported RCC for network configuration changes such as IP blocking, ACL modification, and signature deployment; where the Contractor does not administratively control the sensor grid, submit internal defensive measure recommendations (with operational impact analysis and risk justification) to the appropriate Configuration Control Board (CCB) or Designated Approving Authority
 * Capture and perform initial analysis of volatile data, log data, and captured network traffic; maintain incident chain of custody IAW ARCYBER F&MA procedures and coordinate shipment of original forensic evidence to ARCYBER F&MA for imaging when required.
 * Maintain quality control of incident records to ensure CJCSM 6510.01B compliance, conduct incident trend analyses, and ensure all investigation data is fed to the designated ARCYBER incident-handling portal with the most current action visible.