> Markdown version of [/jobs/ext/4519359-cyber-security-analyst](https://www.wearedevelopers.com/jobs/ext/4519359-cyber-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Security Analyst

- **Company:** Trinity Cyber, Inc.
- **Location:** Baltimore, MD, United States
- **Contract:** Permanent contract
- **Skills:** JavaScript (Programming Language), Cyber Security, Computer Networks, Domain Name System (DNS), Intrusion Detection and Prevention, Python (Programming Language), Pcap, Log Analysis, Simple Mail Transfer Protocols, Network Architecture, Network Forensics, Packet Analyzer, Open Source Intelligence, Windows PowerShell, Regular Expressions, Security Information and Event Management, TCP/IP, Wireshark, Snort (Software), Transport Layer Security, Mitre Att&ck, Malware, Decoding, Cyber Warfare, Splunk
- **Published:** November 2, 2026
- **Apply:** https://www.juju.com/job/18_2757_50145123

## About the Role

* Active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.
 * Local to the Washington, DC metro area, with the ability to work on-site at the customer location.
 * Prior experience as a Security Operations Center (SOC) analyst, threat hunter, incident responder, or in a similar cyber operations role, with a strong understanding of adversary tradecraft, analyst workflows, event triage, investigations, and incident response.
 * Prior hands-on experience developing, tuning, validating, or operationalizing network detection technology in production environments, with depth sufficient to scope, evaluate, and guide detection engineering performed by others.
 * Experience supporting cybersecurity operations within classified government environments.
 * Demonstrated ability to rapidly learn complex cybersecurity technologies and become the trusted technical authority for those capabilities., * Network traffic analysis, including expert-level packet analysis (PCAP) and deep, layer-by-layer understanding of protocols such as TCP/IP, DNS, TLS, SMB, SMTP, and QUIC, including how adversaries abuse them.
 * Experience with detection technologies such as YARA, Suricata, Snort, Sigma, Wireshark, or comparable frameworks.
 * Scripting and automation skills in Python, PowerShell, JavaScript, or similar, including developing and testing complex regular expressions (PCRE).
 * Experience with malware triage, payload decoding, deobfuscation, and behavioral analysis.
 * Familiarity with the MITRE ATT&CK framework as applied to detection development.
 * Experience with enterprise SIEM platforms (Splunk preferred) and log analysis.
 * Experience conducting operationally secure open-source intelligence (OSINT) research is a plus.
 * Excellent written and verbal communication skills, with the ability to explain complex technical concepts to analysts, engineers, and government leadership.

## Description

* Drive Countermeasure Operations: Translate customer-unique cyber threat intelligence into FCI countermeasure and Course of Action (COA) recommendations. Work with the customer to decouple internet-observed adversary tactics, techniques, and procedures (TTPs) from classified reporting. Identify countermeasure gaps and opportunities as threats emerge. Translate new FCI detection/countermeasure requirements to Trinity Cyber's engineering teams.
 * Research Adversary Tradecraft: Study adversary TTPs, analyze network traffic and PCAPs at the protocol level, and identify how adversaries abuse, or hide within legitimate traffic, then turn those findings into opportunities to counter the adversary at scale. Maintain expertise on emerging threats, malware, and FCI methodologies.
 * Advise the Customer: Evaluate customer network architectures, traffic flows, and enclave boundaries to advise on optimal FCI placement, coverage, and blind spots. Help analysts integrate FCI into detection, investigation, and incident response workflows, and assist cyber investigations where FCI can improve detection fidelity and operational outcomes.
 * Close the Loop: Communicate technical findings and recommendations to both government and Trinity Cyber engineering teams, and capture customer operational requirements as product feedback that shapes future FCI capabilities.