> Markdown version of [/jobs/ext/4290135-tier-1-security-operations-center-soc-analyst-secret-or-ts-clearance](https://www.wearedevelopers.com/jobs/ext/4290135-tier-1-security-operations-center-soc-analyst-secret-or-ts-clearance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Tier 1 Security Operations Center (SOC) Analyst - Secret or TS Clearance

- **Company:** IBSS Corp.
- **Location:** Boulder, CO, United States
- **Experience:** Starter
- **Salary:** $65,000.0 - $70,000.0
- **Contract:** Internship / Graduate position
- **Skills:** Microsoft Windows, JIRA, CompTIA Network+, CompTIA Security+, Cyber Security, Information Systems, Linux, Domain Name System (DNS), Issue Tracking Systems, Intrusion Detection Systems, Python (Programming Language), Network Architecture, Packet Analyzer, Windows PowerShell, Anti-Phishing, Kusto Query Language, Security Information and Event Management, TCP/IP, Wireshark, Data Processing, Scripting, Computer Network Operations, Mitre Att&ck, Malware, Azure Security Center, Information Technology, Palo Alto Networks, Microsoft Sentinel, Cortex XSOAR Platform, Splunk, SentinelOne Expertise, Servicenow
- **Published:** October 14, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=37db48391caad9d3

## About the Role

* Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field
 * 0 to 2 years of experience in IT, security operations, network operations, or a related technical field (internships, labs, and military experience count)
 * A DoD 8140/8570-compliant baseline certification at IAT Level II or higher (such as CompTIA Security+ CE), or the ability to obtain one within 6 months of hire
 * Foundational knowledge of TCP/IP, common ports and protocols, DNS, and network architecture
 * A working understanding of Windows and Linux operating systems and their logs
 * Familiarity with common attack types, including phishing, malware, brute force, and lateral movement
 * Basic understanding of the incident response lifecycle and the MITRE ATT&CK framework
 * Strong attention to detail and the ability to follow procedures consistently
 * Clear written and verbal communication skills for ticket documentation and escalations
 * Willingness to work rotating shifts, nights, weekends, and holidays as needed for 24x7 coverage

Desired Skills:

 * Hands-on experience with Microsoft Sentinel, SentinelOne, and Palo Alto XSOAR
 * Exposure to EDR tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne
 * Additional certifications such as CompTIA CySA+, CompTIA Network+, GIAC GSEC, or Splunk Core Certified User
 * Basic scripting or query skills (PowerShell, Python, KQL, or SPL)
 * Familiarity with packet analysis tools such as Wireshark
 * Experience with ticketing and case management systems such as ServiceNow or Jira
 * Familiarity with federal security frameworks and guidance (NIST SP 800-53, NIST SP 800-61, FISMA)
 * Experience in a SOC, NOC, or help desk environment
 * Completed hands-on training platforms or labs (TryHackMe, Hack The Box, or similar)

## Description

The Security Operator I is an entry-level member of the Security Operations Center (SOC). The role provides continuous monitoring and first-tier triage of security events across the customer's enterprise. The Operator watches SIEM, EDR, IDS/IPS, and other security tool consoles, then evaluates the alerts against established playbooks and standard operating procedures. They separate false positives from true security events and escalate confirmed or suspected incidents to Tier 2 analysts and incident responders. The Operator documents each event in the ticketing system and keeps records accurate and complete. They also support the SOC's situational awareness by tracking investigation status, reporting findings, and helping educate users on security procedures. The role works under close supervision, may involve shift work as part of 24x7 coverage, and builds the foundational skills needed to advance to Tier 2 analysis., * Monitor SIEM, EDR, IDS/IPS, firewall, email security, and other security tool consoles in real time for events that may point to an incident

 * Perform initial triage of alerts using established playbooks and SOPs, and determine whether each is a false positive, benign activity, or a potential incident
 * Escalate validated or suspected incidents to Tier 2 analysts and incident response staff on time, with the supporting evidence attached
 * Create, update, and close tickets in the case management system, with clear and accurate documentation of actions taken
 * Review user-reported phishing emails and suspicious activity reports, and perform basic analysis of headers, URLs, and attachments
 * Conduct basic research on indicators of compromise (IPs, domains, file hashes) using threat intelligence sources and reputation tools
 * Identify potential threats and respond to reported security violations under the direction of senior SOC staff
 * Help determine the causes of security events, and recommend improvements to monitoring rules and procedures
 * Track the status of open investigations and contribute to shift turnover reports, daily summaries, and metrics reporting
 * Follow incident handling, data handling, and chain-of-custody procedures in line with customer policy and NIST SP 800-61 guidance
 * Assist in educating users on security procedures and report suspicious trends to SOC leadership
 * Maintain awareness of current threats, vulnerabilities, and attacker techniques relevant to the customer environment