SecOps Analyst
Employment Type:
Full Time
Directorate:
Cyber Security Engineering
Location:
Northern Virginia, Tysons Corner / Reston
Clearance:
Active TS/SCI with Polygraph Required
Experience Level:
Mid-Level, 3+ Years
Altus Consulting is seeking skilled SecOps Analysts to support continuous security monitoring, incident triage, investigation, and response within a 24/7/365 cleared cloud Security Operations Center. The selected candidates will monitor security telemetry, investigate alerts, enrich events with relevant context, document findings, and maintain ownership of security incidents through escalation and closure.
This position is ideal for disciplined security professionals who thrive in an operational environment and take pride in high-quality analysis, documentation, and teamwork. Candidates with backgrounds in SOC operations, cyber defense, military cyber operations, incident response, or cleared IT operations are encouraged to apply.
RESPONSIBILITIES:
- Continuously monitor security alerts and events using SIEM, EDR, IDS, and other cybersecurity platforms.
- Perform initial alert triage, enrichment, event correlation, and investigation.
- Categorize and prioritize security incidents based on severity, impact, and established procedures.
- Maintain ownership of assigned alerts throughout investigation, escalation, documentation, and closure.
- Develop clear diagnostic summaries documenting observed activity, analysis performed, indicators of compromise, and recommended disposition.
- Create and maintain security cases using ServiceNow or other designated case-management platforms.
- Escalate incidents in accordance with established SecOps procedures and runbooks.
- Perform structured handoffs for active High and Critical incidents between shifts.
- Support incident documentation, security reporting, situational awareness, and operational metrics.
- Identify opportunities to improve security detections, playbooks, and response processes.
• Collaborate with SecOps Managers, security engineers, incident responders, and other technical teams to resolve security events.
PREFERRED SKILLS:
- Experience working in a Security Operations Center, Cyber Defense Team, Cyber Incident Response Team, military cyber organization, or similar operational environment.
- Hands-on experience with Splunk, Elastic/ELK, Google SecOps/Chronicle, or comparable SIEM technologies.
- Experience with EDR, IDS/IPS, network monitoring, and security case-management platforms.
- Experience with ServiceNow or comparable ticketing and case-management tools.
- Familiarity with Google Cloud security capabilities, including Security Command Center, Cloud Audit Logs, IAM, and GKE.
- Knowledge of MITRE ATT&CK, threat hunting, detection engineering, and incident response practices.
- Experience supporting Windows and Linux systems and network infrastructure.
- Familiarity with Kubernetes or air-gapped computing environments.
- Python or PowerShell scripting experience.
• Previous experience supporting classified, SCIF, Intelligence Community, Department of Defense, or Federal cybersecurity environments.
BASIC QUALIFICATIONS:
- Active TS/SCI clearance with Full Scope Polygraph is required.
- U.S. Citizenship is required.
- Three or more years of experience in Security Operations, Cyber Security, Systems Administration, or a comparable technical operations environment.
- Hands-on experience with SIEM, IDS, EDR, and case-management or ticketing technologies.
- Experience supporting Windows and Linux environments, network infrastructure, and security applications.
- Working knowledge of network analysis, vulnerability scanning, and security hardening practices.
- Strong analytical, documentation, written, and verbal communication skills.
- Ability to support a 24/7 operational environment, including assigned day, swing, night, weekend, or holiday coverage.
• Ability to satisfy customer-specific onboarding, access, training, and qualification requirements.
REQUIRED / QUALIFYING CERTIFICATIONS:
Candidates must possess an applicable Cyber Defense Analyst role-qualifying certification prior to performing billable work. Applicable certifications identified for this position include:
- CompTIA CySA+
- GIAC Certified Intrusion Analyst (GCIA)
- GIAC Certified Incident Handler (GCIH)
- Certified Ethical Hacker (CEH)
- CISSP