Cyber Real Time Analyst (TN19)

1) 24/7/365 Real-Time Threat Detection, Watch Operations & Triage

• Continuous SOC Monitoring: Execute 24/7/365 real-time security monitoring, alert intake, and alert triage across JFN transport layer components, edge nodes, and out-of-band management channels.
• Log Aggregation & Syslog Auditing: Conduct manual syslog reviews and ingest pipeline verification to identify malicious activity, configuration drifts, or indicators of compromise.
• Elastic SIEM Operations: Leverage and help operationalize the enterprise Security Information and Event Management (SIEM) environment utilizing Elastic Search / Elastic Defend, analyzing Kibana dashboards and basic Elastic alerts to uncover stealthy intrusions.
• Workflow & Incident Tracking: Enforce standardized incident intake, triage, tracking, and escalation workflows utilizing Atlassian JIRA across all watch rotations.

• Incident Response Execution: Support the development, operational testing, and live execution of the JFN Incident Response Plan.
• DIA-Aligned Reporting: Ensure full compliance with Defense Intelligence Agency requirements for TS/SCI incident handling; rigorously document, triage, and escalate network spills, security breaches, unauthorized access attempts, and operational anomalies via mandated channels within required timeframes.
• CSSP Service Delivery: Deliver operational execution for four of the seven DoD Cybersecurity Service Provider core functions during Phase I standup, expanding into full operational capability during Phase II sustainment.

• Advanced Sensor Operations: Monitor, operate, and provide tuning recommendations for high-fidelity network security sensors, such as Corelight (Zeek-based telemetry) and Darktrace Managed Detection & Response.
• Novel Threat Hunting Playbooks: Develop, test, and document novel threat hunting playbooks targeting behavioral anomalies, out-of-band communication channels, lateral movement, and advanced traffic patterns across JFN SD-WAN nodes.
• Containment & Response Playbooks: Leverage JIRA to author, refine, and maintain repeatable standard operating procedures (SOPs) and runbooks for containment actions, remediation coordination, and defensive countermeasures.
• Cross-Functional Collaboration: Partner closely with JFN Tier II NOC engineers (SolarWinds/Jira), DISA enterprise boundary defenders, and NIWC data pipeline engineers ingesting Palo Alto ATP, Prometheus, and endpoint telemetry.

• Citizenship: Must be a U.S. Citizen.
• Security Clearance: Must possess an active Top Secret clearance with current SCI eligibility (adjudicated Tier 5 / SSBI) prior to start date, with the ability to maintain clearance while working in a secure SCIF environment.

• Level II (Intermediate): Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or related technical discipline with 2+ years of direct SOC / defensive cyber operations experience; OR an Associate degree with 4+ years ; OR 6+ years of relevant experience/military service in lieu of degree.
• Level III (Senior): Bachelor’s degree in a technical discipline with 4+ years of direct SOC / CND experience; OR an Associate degree with 6+ years ; OR 8+ years of relevant experience/military service in lieu of degree.

• Must hold an active certification or degree meeting DoD 8140.03 / DCWF Work Role Code 531 Cyber Defense Analyst at the Intermediate Proficiency Level prior to start.
• Accepted Certifications include: CySA+, CCNA-Security, GICSP, GSEC, Security+ CE, CND, CEH, or higher (e.g., CASP+ CE, CISSP, GCIA, GCIH) .

• Proven hands-on experience in a live 24/7/365 Security Operations Center (SOC) conducting real-time event correlation, alert triage, and intrusion analysis.
• Practical knowledge of SIEM technologies, specifically Elasticsearch, Logstash, Kibana (ELK Stack) / Elastic Defend , with proficiency in writing KQL queries and interpreting alerts.
• Experience utilizing JIRA for ticket workflow management, incident intake, and task tracking.
• Strong grasp of network protocols (TCP/IP, UDP, ICMP, BGP, DNS, TLS), packet inspection tools (Wireshark, tcpdump), and syslog parsing.
• Ability and willingness to work 24/7/365 rotating shift schedules (covering days, nights, weekends, and holidays) on-site inside a secure SCIF.

• Prior experience defending DoD networks across Impact Level 6/7 (IL-6/7) , SIPRNet, or TS/SCI / JWICS enclaves.
• Hands-on experience with Corelight (Zeek) sensor analysis, Darktrace MDR , or Palo Alto Advanced Threat Prevention (ATP) logs.
• Experience developing structured threat hunting playbooks or detection logic mapped to the MITRE ATT&CK for Enterprise framework.
• Experience supporting C4ISR systems or joint tactical enclaves (e.g., PMN).