Job Description

cFocus Software seeks a Security Operations Analyst to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.

Qualifications:

• Active TS/SCI clearance
• B.S. Computer Science, Information Technology, or a related field
• Experience monitoring security events, investigating alerts, and supporting enterprise incident response.
• Ability to correlate telemetry, assess anomalies, and document investigation findings.
• Knowledge of network protocols, endpoints, access controls, and cyberattack techniques.
• Experience with security monitoring, log analysis, endpoint detection, and vulnerability tools.
• Ability to hunt threats and apply intelligence to investigations and detection improvements.
• Understanding of incident response, evidence handling, and approved escalation procedures.
• Ability to analyze vulnerabilities and coordinate remediation with technical teams.
• Strong analytical judgment, collaboration, and writing skills for timely investigations

Duties:

• Monitor and triage security alerts, logs, and events; correlate available telemetry to identify suspicious activity and potential threats.
• Analyze network, endpoint, application, and cloud security data within assigned environments to determine event validity, severity, scope, and mission impact.
• Conduct data and intelligence-driven threat hunting to identify hidden or advanced threats in DC3 IT and OT environments.
• Investigate anomalous behavior, distinguish false positives from potential incidents, and document evidence, findings, and recommended responses.
• Detect, analyze, and respond to suspected security incidents; escalate confirmed incidents through established Government-approved procedures.
• Perform assigned containment, eradication, and recovery activities upon incident confirmation, within authorized procedures and access permissions.
• Maintain incident records, timelines, investigation notes, and supporting evidence in accordance with approved handling and documentation procedures.
• Coordinate incident response and recovery with infrastructure, network, application, cloud, and cybersecurity teams; verify assigned corrective actions.
• Analyze vulnerability assessment findings, support risk prioritization and remediation tracking, and coordinate validation with certified assessment specialists.
• Provide continuous analysis of security events and trends; recommend detection improvements and mitigation actions for Government consideration.
• Support operation and maintenance of assigned SOC tools and sensors; identify telemetry gaps and coordinate corrective action with responsible teams.
• Support SOC coordination with Cybersecurity Service Providers (CSSPs), the AFCYBER Operations Center, and applicable higher headquarters authorities.
• Track assigned cyber orders and taskers; coordinate status, required actions, and supporting evidence through approved command and control channels.
• Contribute incident response procedures, lessons learned, security monitoring documentation, and evidence supporting compliance activities.
• Research emerging threats, cybersecurity practices, and technologies; document benefits, risks, and implementation recommendations.