Tier 2 Security Operations Center (SOC) Analyst

Leidos is seeking an experienced Tier 2 Security Operations Center (SOC) Analyst to support the Defense Manpower Data Center (DMDC)   CyberPRIMES   program. Leidos is a major partner on the contract and will provide a substantial   portion   of the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC.    The Tier 2 SOC Analyst will perform advanced analysis of cybersecurity events escalated from Tier 1 or   identified   through enterprise monitoring capabilities. This position will correlate security data,   determine   the scope and potential impact of suspicious activity, support incident triage and containment, preserve evidence, and coordinate with incident responders and other cybersecurity teams to protect DHRA systems and networks.  Work Locations:  Mark Center, Alexandria, Virginia – 3 positions  Department of Defense Center – Monterey Bay, Seaside, California – 3 positions  Clearance: Active Secret security clearance required at time of consideration. U.S. Citizen is a must. Mission Environment  DMDC supports the Defense Human Resources Activity within the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)) and maintains the Department of Defense’s largest and most comprehensive central repository of personnel, manpower, casualty, pay, entitlement, personnel security, identity, readiness, training, and related data. The DHRA Information Technology (IT) environment includes approximately 15,000 network and endpoint devices supporting more than 600 Government-Off-The-Shelf (GOTS) applications and approximately 100 Risk Management Framework (RMF) authorization boundaries managed through the Enterprise Mission Assurance Support Service (eMASS). The Tier 2 SOC Analysts   operate   within a 24x7 security operations environment responsible for detecting, analyzing, escalating, and supporting response to cybersecurity activity affecting DHRA systems and networks. Tier 2 analysts provide the deeper technical analysis   required   when events cannot be resolved through   initial   Tier 1 triage.

Perform advanced analysis of cybersecurity events escalated from Tier 1 analysts or   identified   through endpoint, user-activity, network, and other enterprise monitoring capabilities.  Correlate alerts, security telemetry, and supporting technical data to   determine   the nature, scope, severity, and potential impact of cybersecurity activity.  Distinguish legitimate activity, false positives, policy violations, suspicious behavior, and potential cybersecurity incidents.  Determine   appropriate next   actions based on approved SOC procedures, playbooks, and escalation criteria.  Recommend or   initiate   authorized actions to   contain   or mitigate   identified   threats.  Support cybersecurity incident triage, escalation, and containment in coordination with the incident-response team.  Preserve relevant technical evidence and supporting information required for further investigation and incident response.  Document investigative actions, analysis, findings, and conclusions in Government-approved systems.  Maintain complete and   accurate   event records, tickets, timelines, and supporting evidence.  Contribute to required SOC event reporting and operational status information.  Perform Tier 2 troubleshooting of cybersecurity tools, alerts, security data, and related technical issues.  Use approved Commercial-Off-The-Shelf (COTS) security-analysis tools to investigate cybersecurity events.  Support security testing, mitigation activities, and cybersecurity compliance checking as required by SOC operations.  Coordinate analysis with incident responders, network engineers, endpoint-security personnel, cybersecurity-tool teams, system administrators, and other cybersecurity stakeholders.  Identify   recurring false positives, detection gaps, or ineffective alerting and recommend