Location: Rockville, MD (Primarily Onsite)
Position Summary
The Cybersecurity Analyst supports the Security Incident Response Team (SIRT) by monitoring, triaging, analyzing, and investigating cybersecurity events and potential incidents across the enterprise environment.
The position works closely with the Senior Cybersecurity Analyst, SOC Lead, Detection Engineer, Vulnerability Management personnel, and other cybersecurity team members to identify potentially malicious activity, determine appropriate escalation, support incident-response activities, and maintain accurate investigation documentation.
This role provides additional operational analysis capacity for the SOC while supporting the continued maturation of security monitoring, investigation, detection, and response processes.
Key Responsibilities
Security Monitoring & Alert Triage
- Monitor and review security alerts generated by Splunk Enterprise Security and other approved cybersecurity technologies.
- Perform initial triage of security events to determine validity, severity, scope, and potential impact.
- Analyze security activity involving users, endpoints, hosts, IP addresses, accounts, applications, and other security-relevant entities.
- Enrich alerts using available endpoint, network, identity, vulnerability, asset, and threat information.
- Distinguish expected or non-actionable activity from activity requiring further investigation.
- Escalate potentially significant cybersecurity events in accordance with established SIRT procedures.
Cybersecurity Investigation
- Conduct cybersecurity investigations under the guidance of the Senior Cybersecurity Analyst and SOC Lead.
- Correlate security events across multiple data sources to identify suspicious behavior and potential attack activity.
- Develop timelines and document relevant evidence associated with security investigations.
- Assist with determining the scope and potential impact of identified cybersecurity activity.
- Support investigation of endpoint, account, network, malware, phishing, policy-violation, and other cybersecurity events.
- Coordinate with appropriate technical teams and system owners when additional information or remediation action is required.
- Support evidence collection and preservation as required by established incident-response procedures.
Incident Response Support
- Support SIRT response activities during confirmed or suspected cybersecurity incidents.
- Assist with investigation, containment, remediation, recovery, and post-incident activities as assigned.
- Escalate significant findings to the Senior Cybersecurity Analyst, SOC Lead, and appropriate stakeholders.
- Support high-criticality incident-response activities when activation is required.
- Participate in incident reviews and lessons-learned activities.
- Assist with identifying opportunities to improve incident-response procedures and playbooks.
Detection & Continuous Improvement Support
- Provide feedback to the Detection Engineer regarding noisy, ineffective, or insufficiently enriched detections.
- Identify recurring false-positive or non-actionable alert patterns.
- Assist with testing and validating new or modified security detections from an analyst perspective.
- Identify opportunities for automated enrichment, triage, documentation, and other workflow improvements.
- Participate in testing and validation of SOC automation and AI-assisted cybersecurity capabilities.
- Provide operational feedback on whether new tools, detections, and automations improve analyst effectiveness.
Documentation & Reporting
- Maintain accurate and timely documentation of security investigations, findings, actions, and dispositions.
- Develop and maintain investigation procedures, playbooks, checklists, and supporting documentation.
- Assist with collection of operational metrics supporting SIRT monthly reporting and continuous improvement.
- Maintain investigation records in approved SIRT systems and repositories.
- Support knowledge sharing and cross-training within SIRT.
Required Qualifications
- Experience supporting cybersecurity operations, security monitoring, incident response, or comparable cybersecurity functions.
- Experience reviewing and analyzing security alerts and event data.
- Working knowledge of SIEM technologies, preferably Splunk Enterprise Security.
- Understanding of common cybersecurity threats, attack techniques, and indicators of compromise.
- Familiarity with endpoint, network, identity, authentication, and security-log analysis.
- Understanding of cybersecurity incident-response processes.
- Familiarity with MITRE ATT&CK or comparable threat frameworks.
- Ability to analyze information from multiple security sources and develop defensible conclusions.
- Strong troubleshooting, analytical, documentation, and communication skills.
- Ability to work collaboratively with senior analysts, security engineers, system administrators, and other technical personnel.
Preferred Qualifications
- Hands-on experience with Splunk Enterprise Security.
- Experience with Microsoft Defender for Endpoint or comparable EDR technologies.
- Experience analyzing Windows, Active Directory, Entra ID, network, firewall, DNS, and endpoint telemetry.
- Familiarity with vulnerability-management platforms such as Tenable.
- Experience with ServiceNow or comparable enterprise workflow/case-management systems.
- Experience investigating phishing, malware, suspicious authentication, endpoint, account, and network-security events.
- Familiarity with threat intelligence and enrichment tools.
- Experience working within federal government or similarly regulated environments.
- Security+, CySA+, GCIH, GCIA, or comparable cybersecurity certification preferred.
Key Performance Areas
The Cybersecurity Analyst will contribute to SIRT performance across:
- Triage Effectiveness - accurately evaluating and prioritizing security activity.
- Investigation Quality - conducting complete, well-supported cybersecurity investigations.
- Escalation Effectiveness - identifying and appropriately escalating activity requiring additional response.
- Operational Efficiency - helping reduce investigation backlog and improve analyst workflow.
- Continuous Improvement - providing analyst feedback that improves detections, automation, playbooks, and security operations.
Role Relationship
The Cybersecurity Analyst will work primarily in support of and alongside the Senior Cybersecurity Analyst, providing additional operational capacity for security monitoring, triage, and investigation.
The role is intended to strengthen SIRT's analytical depth while allowing responsibilities to be appropriately distributed between:
Cybersecurity Analyst - Triage and investigation
Senior Cybersecurity Analyst - Advanced investigation, complex analysis, escalation, and mentoring
Detection Engineer / Splunk SME - Detection engineering, SIEM analytics, and detection optimization
SOC Lead - Operational leadership, incident oversight, escalation, and continuous enhancement