Network Security Analyst 1 - Security

Title: Network Security Analyst 1 Security

Location: Onsite in Austin, TX Local Candidates Only
Duration: Long Term

MOI: Microsoft Teams

Need LinkedIn and Govt Exp (Preferred) 6-7 Years Profile Max

Position Overview

Seeking a Network Security Analyst 1 to support its Cybersecurity Operations Centre (CSOC). The analyst will monitor, triage, investigate, and analyse cybersecurity alerts and suspicious activity across enterprise networks, endpoints, cloud environments, email systems, identity platforms, and security infrastructure.

The successful candidate will help identify potential threats, investigate security incidents, document findings, support incident response, and escalate confirmed threats to appropriate cybersecurity teams.

Key Responsibilities

• Monitor and triage cybersecurity alerts from SIEM, EDR/XDR, cloud security, email security, identity protection, and network security platforms .
• Investigate security events to determine severity, scope, impact, and risk.
• Identify and prioritize potential cybersecurity incidents.
• Escalate confirmed threats to Incident Response, Threat Hunting, or SOC Engineering teams.
• Correlate events from:
  • Endpoints and EDR
  • Firewalls
  • IDS/IPS
  • Cloud services
  • Authentication systems
  • Threat intelligence feeds
• Investigate indicators of compromise (IOCs), phishing, malware, suspicious network activity, and anomalous user behaviour .
• Document investigations, findings, and response activities in ticketing/case-management systems.
• Assist with incident containment, eradication, and recovery.
• Perform vulnerability assessment reviews and help prioritize remediation.
• Support alert tuning and reduction of false positives.
• Maintain SOC procedures, playbooks, workflows, and knowledge-base documentation.
• Research emerging cyber threats, attack techniques, tactics, and procedures.

Required Technical Skills

Candidates should have experience with cybersecurity operations and security monitoring technologies, including one or more of the following:

SIEM

• NetWitness
• Microsoft Sentinel
• Splunk
• IBM QRadar
• ArcSight
• LogRhythm

Microsoft Security

• Microsoft 365 Defender XDR
• Microsoft Sentinel

Endpoint Security / EDR

• Microsoft Defender for Endpoint
• CrowdStrike
• SentinelOne

Network Security

• IDS/IPS
• Trellix/FireEye
• Corelight
• Firewalls

Threat Intelligence

• VirusTotal
• Google Threat Intelligence
• Cisco Talos
• Recorded Future
• MISP

Vulnerability Management

• Tenable
• Qualys
• Rapid7

Email Security

• IronPort ESA
• Abnormal.ai
• Proofpoint

Cloud Security

• Google Wiz
• MDCA
• Cortex Cloud
• Sysdig

SASE

• Zscaler
• Prisma
• Netskope

Query & Scripting Skills

Experience with security query and scripting languages is valuable, including:

• KQL
• SPL
• Lucene
• ESQL
• PowerShell
• Python
• Bash

Knowledge Required

• SOC/CSOC operations and best practices
• Security alert triage and investigation
• Incident response and escalation
• Threat detection
• Malware, phishing, APTs, insider threats, and common attack vectors
• IOCs and IOAs
• MITRE ATT&CK
• Windows and Linux
• Networking protocols
• Active Directory
• Microsoft Entra ID
• Cloud security environments
• Enterprise security controls
• NIST Cybersecurity Framework
• NIST Incident Response guidance
• PICERL

Required Qualifications

The solicitation requires experience in areas such as:

• Security alert triage
• Security event analysis
• Incident investigation and documentation
• Cybersecurity frameworks
• Incident response processes
• Threat detection methodologies
• Cybersecurity operations
• Security monitoring
• Threat detection
• Security investigations

The formal job description calls for 5 years of cybersecurity operations/security monitoring/incident response/threat detection/security investigation experience , while the Candidate Skills and Qualifications table lists 3 years as the minimum requirement for each individual listed competency .

Education & Certifications

A four-year degree in one of the following is preferred:

• Cybersecurity
• Information Security
• Computer Science
• Computer Information Systems
• Management Information Systems
• Related field

Relevant education and experience may substitute for one another.

Certifications:

• CompTIA Security+
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• Certified SOC Analyst (CSA)
• Microsoft Cybersecurity Analyst (SC-200)
• Other GIAC or SOC-related certifications

Compliance & Submission Requirements

Selected candidates will be subject to HHSC requirements including:

• Background/criminal history investigation
• E-Verify compliance
• Acceptable Use Agreement
• HHSC IT Staff Augmentation Contractor Integrity Agreement (IT Form 4710)
• HHS Information Security Cybersecurity Training Acknowledgement (Form 3834)
• Other applicable HHSC/state security requirements

Only one candidate may be submitted for this solicitation, and the candidate packet must be merged into a single PDF in this order:

1. Candidate Qualification Form
2. Candidate Resume
3. Candidate Reference Form
4. Candidate Acknowledgement Form

Ideal Candidate Profile

The strongest candidate will be a SOC/CSOC or Cybersecurity Operations Analyst with hands-on experience in SIEM + EDR + incident response + threat detection , preferably with tools such as Microsoft Sentinel, Defender XDR, CrowdStrike, Splunk, QRadar, or similar platforms . Strong candidates should also demonstrate experience investigating IOCs, correlating security events, using KQL/SPL or similar query languages, documenting incidents, and working within frameworks such as MITRE ATT&CK and NIST .