> Markdown version of [/jobs/ext/4639365-tier-1-watch-analyst](https://www.wearedevelopers.com/jobs/ext/4639365-tier-1-watch-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Tier 1 Watch Analyst

- **Company:** Sentar, Inc.
- **Location:** Charleston, SC, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Systems Engineering, Cyber Security, Data Security, Linux, Digital Forensics, Internet Security, Intrusion Detection Systems, Network Intrusion Detection Systems, Packet Analyzer, Data Logging, Information Technology, Splunk
- **Published:** November 8, 2026
- **Apply:** https://www.careerbuilder.com/job-details/tier-1-watch-analyst-charleston-sc--bb1ea080-7588-4b2f-9590-171e333f3f57

## About the Role

Analysis Skills, Systems Engineering, Internet Security, Talent Management, Analysis Skills, Information/Data Security (InfoSec), Documentation, Standard Operating Procedures (SOP), Intrusion Detection Systems, Incident Response, Clearance Level: Secret, with ability to obtain Top Secret/Sensitive Compartmented Information (TS/SCI)

Education: Bachelor's degree in Cybersecurity, Computer, Electrical, or Electronics Engineering, or Mathematics with a concentration in computer science or equivalent OR a high school diploma/GED with 2+ years of practical experience demonstrating competency in Cybersecurity Engineering, Test & Evaluation (T&E) or Assessment & Authorization (A&A)/ Certification & Accreditation (C&A) related field.

Certifications:

 * DoD 8570 IAT Level II
 * CNDSP Analyst
 * OS/CE certification (FEDVTE Linux OS; FEDVTE Windows OS; Server+)

Experience:

At least 2+ years' experience in a Cybersecurity Service Provider (CSSP) environment or similar.

 * Knowledge of Incident Response Procedures
 * Knowledge of Packet Analysis
 * Knowledge of IDS/IPS solutions
 * Familiarity with various Host-Based Tools
 * Familiarity with various operating system logging
 * Experience with Log Aggregation Tools
 * Logical thinking and analytical ability
 * Verbal and written communication ability
 * Knowledge of CJCSM 6510.01B
 * Experience with Digital Forensics
 * The ability to solve problems independently

## Description

The CSSP DCO Watch Analyst (Tier 1) will identify, isolate, investigate, inform, and implement measures to detect and protect data across a wide spectrum of sources and locations. The Watch Analyst is required to validate suspicious events or reports and determine if the event constitutes an incident. The candidate will ensure incidents are properly entered into the appropriate reporting system and determine the severity of the incident. Reporting and response measures will be taken immediately in order to satisfy the Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B reporting requirements.

 * Compile and maintain internal standard operating procedure (SOP) documentation and ensure associated documentation and capabilities remain compliant with CJCSM 6510.01B and other applicable policy directives.
 * Provide endpoint & network intrusion detection and monitoring, correlation analysis, incident response and support for the Cybersecurity Service Provider (CSSP) and its subscriber sites.
 * Validate suspicious events or reports and determine if the event constitutes an incident, properly entering associated data into the appropriate reporting systems.
 * Perform initial alert triage, document findings against established triage standards, generate initial tickets for suspicious activity, and escalate them to Tier 2 technical personnel for deeper analysis.
 * Provide 24x7 support for the CSSP's Incident Response capability during non-core business hours consistent with CSSP requirements as needed.
 * Perform preliminary host and network log reviews, explore patterns in network and system activity via log correlation using Splunk and supplemental tools, and assist with data collection and basic artifact gathering during campaigns as directed by higher tiers.
 * Identify recurring benign activity to support tuning and whitelisting recommendations that reduce false positives.
 * Participate in program reviews, product evaluations, and onsite certification evaluations, and assist with compiling the draft daily operations report on a rotating basis for review and release by the Watch Officer.