Security Operations Analyst Tier II

Security and Network Operations

About Knox

Knox runs the largest Federal and DoW managed cloud building and operating secure cloud and AI environments that support the U.S. governments most critical missions from national security and public safety to essential public services. Our customers rely on Knox to deploy production systems that meet the highest standards for security reliability and compliance.
Work at Knox is high-impact and purpose-driven. The problems we solve are high stakes the expectations are high and the results are visible. Speed rigor and trust matter here - because the environments we secure cannot fail. Your contributions are visible your expertise is relied upon and the impact of your work is immediate and measurable. We operate at federal scale securing some of the most sensitive government environments in the country - because the systems we build must perform without fail.

About the Role

Knox keeps federal cloud systems running and secure under FedRAMP authorization. Tier 2 is our mid-level analyst role: youll run a shift on your own and the analyst working with you will come to you first when something looks wrong.

How We Work

Most companies run a security team and a network team separately. We dont. At Knox one team watches everything performance availability and security out of the same queue. You see the whole picture and a problem never sits with the wrong team while the clock runs. It is a better way to work and a much faster way to learn.

How We Prioritize

1. Active intrusion or suspected compromise
2. Service-affecting outage
3. Degradation and early warning signs
4. Customer requests and tickets

You set the pace on your shift and you are the one who decides when something moves up the list.

What Youll Do

• Run a shift without supervision you are the senior analyst on duty for most of it.
• Take escalations from Tier 1 and see them through to containment or handover.
• Coach the analyst on duty through the decision rather than taking it away from them.
• Own the quality of your shift log. If the next shift has to call you it wasnt detailed enough.
• Handle escalated customer requests and set the standard for how the queue gets worked.
• Suggest detection and runbook improvements based on what you see on shift.

What Youll Need

• Three or more years of hands-on security or network operations including shift work.
• Good escalation judgment when to contain when to keep watching and when to wake someone up.
• Security or equivalent. CySA or SSCP is a plus and well fund it if you dont have it yet.
• Willingness to teach someone less experienced than you under time pressure.

What Well Teach You

• Our environment our detections and how the FedRAMP evidence chain fits together.
• Detection engineering and tuning at a level Tier 1 doesnt touch.
• The path to Tier 3 shift lead.

What We Dont Require

• A degree.
• Previous corporate experience.
• An active security clearance. If you hold one or held one thats a plus it is never a requirement.

Required Experience:

IC