Unclassified - Colorado Springs, CO
posted 4 months ago
The Security Operation Center (SOC) Analyst Lead plays a crucial role in developing, implementing, and evaluating the SOC team's capabilities to provide comprehensive Computer Network Defense and Response support. This position is responsible for 24/7 monitoring and analysis of potential threat activities targeting the enterprise. The SOC Analyst Lead will lead a team that monitors the organization's network and devices for security breaches, maintains software such as log management, researches the latest security trends, conducts security assessments, and performs compliance reviews of SOC operations. Additionally, this role assists with the maintenance of Security Policy and Procedures and provides training for all SOC personnel. A solid understanding of cyber threats and information security is essential, particularly in the domains of Tactics, Techniques, and Procedures (TTPs), Threat Actors, Campaigns, and Observables. The candidate must be familiar with intrusion detection systems, intrusion analysis, security information event management platforms, endpoint threat detection tools, and security operations ticket management. The SOC Analyst Lead will support activities within Special Access Programs (SAPs) for Department of Defense (DoD) agencies, including HQ Air Force and the Office of the Secretary of Defense (OSD). This position will provide day-to-day support for Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities. Performance expectations include strong analytical and technical skills in computer network defense operations, leading efforts in incident handling (detection, analysis, triage), hunting (anomalous pattern detection and content management), and malware analysis. The SOC Analyst Lead will analyze information technology security events to discern legitimate security incidents from non-incidents, conduct incident investigations, implement countermeasures, and manage incident responses. Knowledge and hands-on experience with Security Information and Event Monitoring (SIEM) platforms and log management systems are critical, as is the ability to analyze security events across various operating systems and network protocols. The role also involves preparing and maintaining security documentation, developing SOC processes and procedures, and effectively communicating business risks associated with cybersecurity issues.