Senior SOC Analyst

Everforth ECS is seeking a Senior SOC Analyst to work in a hybrid capacity at our Fairfax, VA office.

The Senior SOC Analyst will play a key part in standing up and operating the program's Security Operations Center (SOC), including security monitoring, threat hunting, incident analysis, incident response, and SIEM development. This individual will help build the SOC capability from the ground up and will serve as the primary hands-on SOC resource.

The ideal candidate is a highly technical cybersecurity professional who can independently investigate complex alerts and anomalous activity, determine whether events represent legitimate security incidents, and drive confirmed incidents through the full response lifecycle. The Senior SOC Analyst will also help improve detection coverage, incident response processes, documentation, and overall SOC capabilities. The Senior SOC Analyst reports to the Senior Information System Security Manager.

Job Responsibilities:

• Serve as the primary SOC resource for a new unclassified AWS environment.
• Build, configure, tune, and continuously improve SIEM queries, correlation rules, alerts, dashboards, reports, and detection content.
• Monitor and investigate security alerts, notable events, IoCs, and anomalous activity to determine whether activity is an explained anomaly or a potential cybersecurity incident.
• Own confirmed cybersecurity incidents from detection through closure, ensuring incident tickets, timelines, findings, response actions, and supporting evidence remain accurate and complete.
• Perform advanced analysis using endpoint, network, identity, cloud, application, operating system, and other available security telemetry to determine scope, impact, attack vector, and root cause.
• Coordinate incident response activities with cybersecurity, cloud, network, system administration, application, and other technical teams and ensure participating teams document required actions and evidence.
• Ensure incident response activities address detection, analysis, containment, eradication, recovery, and post-incident review.
• Analyze and correlate IoCs, CVEs, threat intelligence, malicious infrastructure, and adversary Tactics, Techniques, and Procedures (TTPs) to determine potential impact and develop appropriate detections, threat hunts, and defensive actions.
• Apply frameworks such as MITRE ATT&CK to support investigations, detection development, and proactive threat hunting.
• Tune detection logic to improve coverage, identify gaps, and reduce false positives.
• Develop and maintain SOC SOPs, incident runbooks, escalation procedures, and other supporting operational documentation.
• Identify opportunities to automate alert enrichment, event correlation, investigation workflows, ticketing, and SOC reporting.
• Develop SOC metrics and reporting to communicate alert trends, incident activity, response performance, and identified security gaps.
• Lead post-incident After Action Reports (AARs), documenting the incident timeline, response activities, lessons learned, root cause, and recommended improvements to detections, controls, and response procedures.
• Mentor junior analysts and provide technical guidance during investigations and incident response activities.
• Continuously evaluate and improve SOC monitoring, detection, investigation, and incident response capabilities.
• Other duties, as assigned.

Salary: $130,000-150,000

General Description of Benefits

• U.S. Citizen.

• Ability to obtain Secret clearance (active preferred)

• Active DoD 8140 IAT Level II Security+ (or higher).

• Ability to work up to 3 days a week in a hybrid capacity out of Fairfax, VA. Additional onsite support may be required based on operational or mission needs.

• 8+ years of cybersecurity experience, including 4+ years in a SOC environment.

• Strong experience with SIEM technologies, including developing queries, correlation rules, alerts, dashboards, reports, and detection logic.

• Demonstrated ability to independently triage and investigate complex security alerts, notable events, anomalous activity, and potential cybersecurity incidents.

• Experience owning cybersecurity incidents through the full response lifecycle, including detection and analysis, containment, eradication, recovery, and post incident review.

• Direct experience supporting security monitoring and incident response in AWS environments, including analysis of CloudTrail, CloudWatch, VPC Flow Logs, GuardDuty, IAM activity, and other AWS security telemetry.

• Strong understanding of Windows, Linux, networking, cloud infrastructure, endpoint security, applications, identity, and authentication as they relate to security monitoring and incident response.

• Experience with the following:

• Analyzing and correlating telemetry from multiple sources, including endpoint, network, identity, cloud, application, and operating system logs.

• Onboarding and validating log sources to ensure security telemetry is complete, accurate, and usable for monitoring and investigation.

• Analyzing identity and authentication activity from Microsoft Entra ID, Active Directory, or similar identity platforms.

• Analyzing Indicators of Compromise (IoCs), CVEs, suspicious authentication activity, and TTPs.

• Conducting proactive threat hunts and developing or tuning detections based on observed activity, threat intelligence, and emerging threats.

• Developing and maintaining SOC procedures, incident response playbooks, runbooks, escalation processes, and operational workflows.

• Working knowledge of MITRE ATT&CK or similar frameworks and experience applying them to investigations, detection development, and threat hunting.

• Ability to:

• Lead technical incident response activities, coordinate actions across multiple technical teams, and ensure incident documentation remains accurate and complete.

• Independently manage SOC operations and prioritize alerts, investigations, incidents, and other operational requirements.

• Strong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution.

• Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management)

• Advanced cybersecurity certifications such as CISSP, CySA+, GCIH, GCIA, GMON, CEH, or similar certifications.

• Experience with the following:

• Supporting cybersecurity operations in DoD, DISA, AWS GovCloud, or other federal environments.

• Elastic Security, including query development, detection rules, dashboards, alert tuning, and security investigations.

• Helping stand up or significantly mature a SOC, including development of monitoring, detection, incident response, and operational processes.

• Monitoring and investigating Kubernetes or containerized environments and working with endpoint security technologies such as Trellix or similar platforms.

#EverforthECS1

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

Everforth ECS is the federal segment of Everforth, a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.

Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

We value:

• Attracting and developing top talent and high-performing teams
• Fostering a culture that is engaging, accountable, and mission-driven

Meet the challenge. Make a difference with Everforth ECS!