> Markdown version of [/jobs/ext/4673150-cyber-security-operations-specialist-ii-tier-2](https://www.wearedevelopers.com/jobs/ext/4673150-cyber-security-operations-specialist-ii-tier-2). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Security Operations Specialist II/Tier 2

- **Company:** Caci Inc
- **Location:** St. Louis, MO, United States
- **Experience:** Experienced
- **Salary:** $63,300 - $129,700
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Geospatial Intelligence, Parsing, Security Information and Event Management, Cyber Threat Analysis, Information Technology, Microsoft Sentinel, Cyber Warfare, Splunk
- **Published:** November 11, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9303312/cyber-security-operations-specialist-iitier-2

## About the Role

* Must be a US citizen with an active TS/SCI to start work; will be required to obtain a CI Poly within 6 months of hire;
 * Typically have a university degree (BA/BS) or equivalent experience and minimum 4 years of related work experience;
 * Hold current certifications that are compliant with DoD 8140.03 and DoD 8570.01-M IAT Level II and CSSP Analyst baseline certification lists;
 * Ability to work 1 of 5 shifts during the week, either 8 hours (weekdays) or 12 hours (weekends).

Desired:

 * DoD 8570 IAT Level III certification;
 * Active TS/SCI based on a counterintelligence (CI) poly;
 * 5+ years of related CSOC tier 2 or 3 work experience.

## Description

CACI helps power and secure the enterprise networks of the National Geospatial-Intelligence Agency (NGA) on its Transport & Cybersecurity Services (TCS) program. The functional capabilities are to coordinate the cybersecurity and information technology (IT) infrastructure services required to deliver timely, relevant, and accurate GEOINT in support of a wide range of missions for the U.S. Department of War (DoW) and the Intelligence Community (IC). TCS provides innovative design, engineering, procurement, implementation, operations, sustainment and disposal of transport and cybersecurity IT resources on multiple networks and security domains, across various locations worldwide.

As a Tier 2 (mid- to upper-skill level) Cyber Defense Analyst, you will serve as the critical analytical bridge between initial triage and advanced incident response for NGA networks. In this role, you will perform deep-dive correlation and analysis of cyber events, leveraging advanced security tools to gather evidence and execute response actions that ensure the agency's cybersecurity posture remains resilient against adversary activity.
You will operate within a dynamic 24x7x365 Cyber Security Operations Center (CSOC), collaborating closely with junior analysts to provide mentorship, and teaming up with senior incident responders to escalate and neutralize complex threats. Beyond steady-state operations, you will actively participate in tabletop exercises, simulations, and major Cyber Incident Response operations to continuously refine and elevate the agency's defensive cyber capabilities.

Responsibilities:

 * Conduct Comprehensive Investigations: Lead investigations into escalated cyber events, building robust case files that accurately characterize the true nature, scope, and potential threat of the activity.
 * Leverage Advanced Analytics: Utilize advanced search queries within SIEM platforms (such as Splunk, Elastic, and Microsoft Sentinel) to parse, analyze, and correlate complex log data.
 * Apply Threat Intelligence: Actively track Malicious Cyber Actor (MCA) intrusion sets based on current threat intelligence and identify correlated Indicators of Compromise (IoCs) within the enterprise environment.
 * Execute & Document Response: Perform appropriate response actions and document your findings in the IT service management system with meticulous detail, ensuring your analysis can be seamlessly reconstructed by peer analysts or leadership.
 * Identify Insider Threats: Proactively identify network activity indicative of potential insider threats and escalate these instances to the agency's counterintelligence element.
 * Classify Cyber Incidents: Evaluate events and provide expert recommendations on incident categorization in strict accordance with CJCSM 6510.01B criteria.
 * Support Enterprise Architecture: Develop and apply a deep understanding of enterprise network architecture and the strategic placement of security devices to contextualize anomalous traffic and strengthen overall network defense.
 * Perform Crisis Operations: Serve as a core member of the Cyber Incident Response Team (C-IRT) during major declared incidents, operating in conjunction with other cyber organizations.
 * Ensure Mission Continuity: Maintain readiness to relocate to a designated Continuity of Operations (COOP) site during exercises or real-world crises to sustain uninterrupted CSOC operations.