Cybersecurity Ops Analyst

Cybersecurity Ops Analyst . For the right candidate, SAIC is open to the position working remotely anywhere in the United States.
This position will either work 2nd shift (2pm-midnight) or third shift (10pm-8am EST).
The SAIC Cybersecurity Ops Analyst performs advanced security event analysis as part of the 24/7/365 Enterprise Security Operations Center (ESOC) Detection & Response team. They also participate in intelligence gathering and contribute to improving procedures and processes within the ESOC. This position requires independent technical judgment, the ability to investigate complex security events, and collaboration with other cybersecurity teams (GRC, architecture, detection engineer, etc.)
Perform in-depth security investigations by analyzing and correlating network, endpoint, system, and cloud telemetry using SIEM and EDR technologies. Evaluate suspicious activity, threat intelligence, and vulnerability information to identify potential threats and assess organizational risk.
Document investigations, findings, supporting evidence, and response actions accurately and consistently in the incident tracking system.
Support the onboarding and training of new analysts through knowledge sharing, cross-training, and technical assistance.
Bachelor’s degree and 2+ years of experience or an Associate’s degree in related discipline and 3+ years or more experience. Must be a US Citizen.
Must have a minimum 2 years of cybersecurity operations related experience.
Hands-on experience with SIEM and EDR technologies, including security alert investigation, endpoint analysis, and correlation of security events.
Working knowledge of network security fundamentals and identification of suspicious network activity.
Working knowledge of Windows, Linux, and cloud environments, including relevant security logs, events and telemetry.
Understanding of common attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CK framework and its application to security investigations.
Strong written and verbal communication skills, including the ability to clearly document investigations and coordinate with technical and nontechnical stakeholders.
Hands-on experience with Splunk Enterprise Security (ES).
Experience participating in the full incident response lifecycles, including containment, eradication, recovery and post-incident analysis.
Familiarity with scripting or automation using Python, PowerShell, or similar technologies to support security investigations and operational efficiency.
SAIC® is a premier mission integrator focused on advancing the power of technology and innovation to serve and protect our world. Our robust portfolio of offerings across the defense, space, intelligence, and civilian markets includes secure high-end solutions in mission IT, enterprise IT, engineering services, and professional services. We integrate emerging technology, rapidly and securely, into mission critical operations that modernize and enable critical national imperatives.
For ongoing news, please visit our newsroom.