Level 2 Cyber Security Analyst

Position Summary

The SOC Analyst II is a mid-level, hands-on investigative role responsible for deep-dive analysis, incident response, and mentorship of Tier 1 analysts within Netrio's Government SOC. This role aligns to the DoD 8140/DCWF Cyber Defense Analyst (511) work role at an intermediate proficiency level and serves as the primary escalation point for confirmed or suspected security incidents across federal and Defense Industrial Base (DIB) client environments hosted in government-authorized cloud platforms.

Key Responsibilities

• Perform in-depth investigation of escalated alerts and incidents using SIEM/XDR and EDR platforms

• Conduct root-cause analysis, threat correlation, and impact assessment across multi-tenant government client environments

• Lead containment, eradication, and recovery actions for confirmed incidents per incident response playbooks

• Own DFARS 252.204-7012 incident reporting workflow, including 72-hour DIBNet reporting coordination and 90-day data preservation requirements

• Perform threat hunting activities across EDR, SIEM, and identity telemetry (conditional access alerts, sign-in logs)

• Mentor and validate escalations from Tier 1 analysts; provide on-shift coaching and quality review of Tier 1 triage decisions

• Refine and author detection use cases, correlation rules, and playbooks based on investigation findings

• Coordinate with client points of contact during active incidents, within defined communication protocols

• Support endpoint management (RMM) and email security investigations as they intersect with broader incidents

• Maintain and validate chain-of-custody and evidence-handling procedures for CUI-related investigations under CMMC Level 2 / NIST SP 800-171

• Participate in tabletop exercises, incident response plan reviews, and audit/assessment support (C3PAO readiness activities)

Required Qualifications

• 2–5 years of experience in a SOC analyst, incident response, or threat hunting role

• Demonstrated experience with at least one SIEM/XDR platform and one EDR platform in a production capacity

• Solid understanding of the cyber kill chain, MITRE ATT&CK framework, and common adversary TTPs

• Experience with log analysis, network traffic analysis, and basic malware/artifact triage

• Strong incident documentation and client communication skills, including under time pressure

• U.S. Citizenship (required for access to government client environments)

• Ability to pass a background investigation as required by client contracts