Job Description Job Description Revolutional delivers advanced technology solutions and mission support to federal agencies across civilian, health, and national security environments. We apply modern capabilities, including AI/ML, cloud, cybersecurity, and IT modernization to solve complex challenges, enable faster and more secure operations, and drive measurable mission outcomes. We are redefining how federal technology gets built and delivered by operating with a product mindset, prioritizing speed, ownership, and execution over bureaucracy. SOC Operations Manager Location: Washington, DC, Ft. Collins, CO, or Kansas City, MO (remote optional, local preferred) Terms: Full-time Salary: $160K - $200K DOE Clearance: Active Secret required Travel: 0-10% Project Description This position supports a large-scale federal security operations program delivering 24/7/365 continuous monitoring, intrusion detection, incident response, and threat intelligence across a complex enterprise network environment. The SOC operates under demanding federal cybersecurity compliance requirements and supports multiple government stakeholders across classified and unclassified networks. The core challenge: sustaining Tier 2 threat watch operations at enterprise scale - validating events, driving accurate incident assessment, and keeping Tier 1 analysts focused, calibrated, and mission-ready around the clock. Position Description As a SOC Operations Manager at Revolutional, you lead the Tier 2 Threat Watch Officer function and are the senior operational authority for event validation, incident assessment, and analyst oversight during your watch. You validate and confirm security events, assess operational impact, correlate anomalies across IDS, IPS, and SIEM platforms, and make real-time recommendations that shape the program's defensive posture. You are a technically deep operator and a credible team leader. You oversee Tier 1 staff, author intrusion detection signatures, monitor High Value Assets, and maintain current threat awareness that you actively apply to improve the program's detection and response capabilities. When events require interagency coordination, you are the person who initiates and manages that engagement. What You Will Own Tier 2 Threat Watch Officer function and operational leadership Security event validation, impact assessment, and escalation decisions IDS/IPS/SIEM anomaly correlation and network configuration recommendations Intrusion detection signature authorship and maintenance High Value Asset monitoring and protection oversight Tier 1 analyst oversight, performance, and operational discipline Interagency coordination for significant security events Current threat awareness and its application to enterprise security posture Responsibilities Lead the Tier 2 Threat Watch Officer function; serve as the senior operational authority for event triage, validation, and incident assessment during assigned watch periods Validate and confirm security events; assess operational impact and determine appropriate response actions, escalation paths, and stakeholder notifications Correlate anomalies across IDS, IPS, and SIEM platforms to distinguish genuine threats from false positives and identify complex, multi-vector attack patterns Recommend network configuration changes to mitigate identified threats, close detection gaps, and strengthen defensive posture Author and maintain intrusion detection signatures to improve detection fidelity against current and emerging threat actors and TTPs Monitor High Value Assets and ensure heightened detection coverage, alert fidelity, and response readiness for critical systems Coordinate with law enforcement, counterintelligence, and interagency partners on significant security events requiring external collaboration or notification Oversee Tier 1 SOC analysts; direct workload, validate analyst actions, enforce SOC procedures, and provide real-time coaching during active events Maintain current awareness of the threat landscape, adversary TTPs, and emerging attack vectors; actively apply threat intelligence to improve program detection and response capabilities Develop and contribute to SOC playbooks, standard operating procedures, and shift documentation Produce accurate shift reports, incident summaries, and escalation notifications for program leadership and government stakeholders Write scripts in Python or equivalent languages to automate analyst workflows, improve detection capabilities, or support SOC tool management What You Bring (Requirements) Baseline Requirements Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience) 5 or more years of security operations experience, including hands-on Tier 2 or senior SOC analyst experience Demonstrated experience in a supervisory or team lead capacity overseeing SOC analysts or watch floor operations Active Secret clearance required Technical & Domain Capabilities Deep experience with security event validation, IDS/IPS/SIEM correlation, and incident impact assessment in enterprise network environments Hands-on experience authoring intrusion detection signatures for IDS/IPS platforms Proficiency with SIEM platforms: search, correlation rule development, alert tuning, and dashboard operations Experience monitoring High Value Assets and applying elevated detection and response protocols Demonstrated ability to recommend and communicate network configuration changes based on threat analysis findings Experience coordinating with external agencies or government partners during significant security events Proficiency scripting in Python or equivalent language for SOC automation, workflow improvement, or tool integration Current knowledge of adversary TTPs, threat actor trends, and the federal cybersecurity threat landscape Familiarity with FISMA, NIST incident response frameworks, and federal security operations standards Core Strengths Technically authoritative Tier 2 operator - your event assessments are accurate, well-reasoned, and defensible under scrutiny Decisive under pressure: you make sound calls on complex, fast-moving events without waiting for perfect information Effective supervisor who holds Tier 1 analysts to standard, develops their tradecraft, and keeps the watch floor operationally disciplined Clear communicator who produces crisp incident documentation, sharp shift handoffs, and credible interagency coordination Certifications One or more of the following is preferred: CISSP, GCIA (GIAC Certified Intrusion Analyst), GCIH (GIAC Certified Incident Handler), CySA+, or equivalent security operations credential Nice to Have (Differentiators) Experience leading Tier 2 operations in a federal civilian, defense, or intelligence SOC environment Background in intrusion detection signature development for commercial and custom IDS/IPS platforms Familiarity with High Value Asset (HVA) monitoring frameworks and CISA HVA assessment processes Experience with threat hunting or kill-chain-based detection methodologies Familiarity with Zero Trust monitoring or cloud-native SOC operations Active TS/SCI clearance _ Here at Revolutional we are pleased to have been repeatedly recognized for our outstanding work culture, the innovative work we do, and the employees on our team who make a difference each day. Some of these recognitions include: Recognized as a Top 20 "Best Place to Work in Virginia" Recipient of Department of Labor's HireVets Gold Medallion Great Place to Work Certification for five years running A Virginia Chamber of Commerce Fantastic 50 company A Northern Virginia Technology Council Tech 100 company Inc. 5000 list of fastest growing companies for eleven years Two-time SBA SBIR Tibbett's Award winner Virginia Values Veterans (V3) Certification We recognize that every bit of our success is the result of our teams of hard-working, motivated, and innovative professionals who are proud to call themselves part of the Revolutional family! In addition to competitive compensation, a family-focused culture, and a dynamic, productive work environment, we offer all full-time employees a variety of benefits including, but not limited to Traditional and HSA- eligible medical insurance plans 100% employer-paid dental and vision insurance options 100% employer-sponsored STD, LTD, and life insurance 5% 401(k) company matching Flexible-schedules and teleworking options Paid holidays and PTO Accrual Plans Paid Parental Leave Professional development and career growth opportunities Team and company-wide events, recognition, and appreciation and so much more! Check out our Revolutional LinkedIn to find out a little more about who we are and if we are the right next step for your career! Revolutional is an Equal Opportunity Employer providing equal employment opportunity to all employees and applicants for employment without regard to race, color, religion, national origin, age, gender, gender identity, sexual orientation, disability, or genetics. Revolutional . click apply for full job details
11/12/2026
Full time
Job Description Job Description Revolutional delivers advanced technology solutions and mission support to federal agencies across civilian, health, and national security environments. We apply modern capabilities, including AI/ML, cloud, cybersecurity, and IT modernization to solve complex challenges, enable faster and more secure operations, and drive measurable mission outcomes. We are redefining how federal technology gets built and delivered by operating with a product mindset, prioritizing speed, ownership, and execution over bureaucracy. SOC Operations Manager Location: Washington, DC, Ft. Collins, CO, or Kansas City, MO (remote optional, local preferred) Terms: Full-time Salary: $160K - $200K DOE Clearance: Active Secret required Travel: 0-10% Project Description This position supports a large-scale federal security operations program delivering 24/7/365 continuous monitoring, intrusion detection, incident response, and threat intelligence across a complex enterprise network environment. The SOC operates under demanding federal cybersecurity compliance requirements and supports multiple government stakeholders across classified and unclassified networks. The core challenge: sustaining Tier 2 threat watch operations at enterprise scale - validating events, driving accurate incident assessment, and keeping Tier 1 analysts focused, calibrated, and mission-ready around the clock. Position Description As a SOC Operations Manager at Revolutional, you lead the Tier 2 Threat Watch Officer function and are the senior operational authority for event validation, incident assessment, and analyst oversight during your watch. You validate and confirm security events, assess operational impact, correlate anomalies across IDS, IPS, and SIEM platforms, and make real-time recommendations that shape the program's defensive posture. You are a technically deep operator and a credible team leader. You oversee Tier 1 staff, author intrusion detection signatures, monitor High Value Assets, and maintain current threat awareness that you actively apply to improve the program's detection and response capabilities. When events require interagency coordination, you are the person who initiates and manages that engagement. What You Will Own Tier 2 Threat Watch Officer function and operational leadership Security event validation, impact assessment, and escalation decisions IDS/IPS/SIEM anomaly correlation and network configuration recommendations Intrusion detection signature authorship and maintenance High Value Asset monitoring and protection oversight Tier 1 analyst oversight, performance, and operational discipline Interagency coordination for significant security events Current threat awareness and its application to enterprise security posture Responsibilities Lead the Tier 2 Threat Watch Officer function; serve as the senior operational authority for event triage, validation, and incident assessment during assigned watch periods Validate and confirm security events; assess operational impact and determine appropriate response actions, escalation paths, and stakeholder notifications Correlate anomalies across IDS, IPS, and SIEM platforms to distinguish genuine threats from false positives and identify complex, multi-vector attack patterns Recommend network configuration changes to mitigate identified threats, close detection gaps, and strengthen defensive posture Author and maintain intrusion detection signatures to improve detection fidelity against current and emerging threat actors and TTPs Monitor High Value Assets and ensure heightened detection coverage, alert fidelity, and response readiness for critical systems Coordinate with law enforcement, counterintelligence, and interagency partners on significant security events requiring external collaboration or notification Oversee Tier 1 SOC analysts; direct workload, validate analyst actions, enforce SOC procedures, and provide real-time coaching during active events Maintain current awareness of the threat landscape, adversary TTPs, and emerging attack vectors; actively apply threat intelligence to improve program detection and response capabilities Develop and contribute to SOC playbooks, standard operating procedures, and shift documentation Produce accurate shift reports, incident summaries, and escalation notifications for program leadership and government stakeholders Write scripts in Python or equivalent languages to automate analyst workflows, improve detection capabilities, or support SOC tool management What You Bring (Requirements) Baseline Requirements Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience) 5 or more years of security operations experience, including hands-on Tier 2 or senior SOC analyst experience Demonstrated experience in a supervisory or team lead capacity overseeing SOC analysts or watch floor operations Active Secret clearance required Technical & Domain Capabilities Deep experience with security event validation, IDS/IPS/SIEM correlation, and incident impact assessment in enterprise network environments Hands-on experience authoring intrusion detection signatures for IDS/IPS platforms Proficiency with SIEM platforms: search, correlation rule development, alert tuning, and dashboard operations Experience monitoring High Value Assets and applying elevated detection and response protocols Demonstrated ability to recommend and communicate network configuration changes based on threat analysis findings Experience coordinating with external agencies or government partners during significant security events Proficiency scripting in Python or equivalent language for SOC automation, workflow improvement, or tool integration Current knowledge of adversary TTPs, threat actor trends, and the federal cybersecurity threat landscape Familiarity with FISMA, NIST incident response frameworks, and federal security operations standards Core Strengths Technically authoritative Tier 2 operator - your event assessments are accurate, well-reasoned, and defensible under scrutiny Decisive under pressure: you make sound calls on complex, fast-moving events without waiting for perfect information Effective supervisor who holds Tier 1 analysts to standard, develops their tradecraft, and keeps the watch floor operationally disciplined Clear communicator who produces crisp incident documentation, sharp shift handoffs, and credible interagency coordination Certifications One or more of the following is preferred: CISSP, GCIA (GIAC Certified Intrusion Analyst), GCIH (GIAC Certified Incident Handler), CySA+, or equivalent security operations credential Nice to Have (Differentiators) Experience leading Tier 2 operations in a federal civilian, defense, or intelligence SOC environment Background in intrusion detection signature development for commercial and custom IDS/IPS platforms Familiarity with High Value Asset (HVA) monitoring frameworks and CISA HVA assessment processes Experience with threat hunting or kill-chain-based detection methodologies Familiarity with Zero Trust monitoring or cloud-native SOC operations Active TS/SCI clearance _ Here at Revolutional we are pleased to have been repeatedly recognized for our outstanding work culture, the innovative work we do, and the employees on our team who make a difference each day. Some of these recognitions include: Recognized as a Top 20 "Best Place to Work in Virginia" Recipient of Department of Labor's HireVets Gold Medallion Great Place to Work Certification for five years running A Virginia Chamber of Commerce Fantastic 50 company A Northern Virginia Technology Council Tech 100 company Inc. 5000 list of fastest growing companies for eleven years Two-time SBA SBIR Tibbett's Award winner Virginia Values Veterans (V3) Certification We recognize that every bit of our success is the result of our teams of hard-working, motivated, and innovative professionals who are proud to call themselves part of the Revolutional family! In addition to competitive compensation, a family-focused culture, and a dynamic, productive work environment, we offer all full-time employees a variety of benefits including, but not limited to Traditional and HSA- eligible medical insurance plans 100% employer-paid dental and vision insurance options 100% employer-sponsored STD, LTD, and life insurance 5% 401(k) company matching Flexible-schedules and teleworking options Paid holidays and PTO Accrual Plans Paid Parental Leave Professional development and career growth opportunities Team and company-wide events, recognition, and appreciation and so much more! Check out our Revolutional LinkedIn to find out a little more about who we are and if we are the right next step for your career! Revolutional is an Equal Opportunity Employer providing equal employment opportunity to all employees and applicants for employment without regard to race, color, religion, national origin, age, gender, gender identity, sexual orientation, disability, or genetics. Revolutional . click apply for full job details
Job Description Job Description Who we are: ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a "work hard, play hard" mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community. The Perks: As recognized members of the Cyber Elite, we work together in partnership to defend our nation's critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individual's technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, major carriers for healthcare providers. Highlighted benefits include 144 hours of PTO, 11 holidays, 85% of insurance premiums covered, a 401(k), continuing education, certification maintenance and reimbursement and more. Who we're looking for: We are seeking an Elasticsearch Engineer (TS/SCI Clearance) with expertise in designing, deploying and optimizing Elastic Stack solutions in federal environments. This role supports the delivery of Elastic-based solutions across cloud, on-prem and hybrid infrastructures to enable security operations and data-driven outcomes. The Elasticsearch Engineer will lead technical implementations, support migrations and contribute to scalable architectures while engaging directly with client stakeholders. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market. What you'll be doing: Architect, deploy and tune Elastic Stack solutions (Elastic Cloud Enterprise (ECE), Elastic Cloud on Kubernetes (ECK), Elastic Cloud) across cloud, on-prem and hybrid environments. Execute legacy security platform migrations, including detection translation (e.g., Search Processing Language (SPL) (ES QL) Elasticsearch Query Language) and analyst workflow modernization. Design and implement data ingestion pipelines using Elastic Agent, Fleet, Logstash and Beats. Harden deployments for federal compliance, including Transport Layer Security (TLS), Personal Identity Verification/Common Access Card (PIV/CAC), Single Sign-On (SSO) / Security Assertion Markup Language (SSO/SAML), Security Technical Implementation Guide (STIG) and audit logging. Build outcome-driven dashboards and advanced Kibana visualizations. Develop automation using Infrastructure-as-Code (IaC) tools (Ansible, Terraform or equivalent). Communicate technical decisions and trade-offs directly to client stakeholders. Contribute to internal IP, including reusable templates, automation and reference architectures. What you need to know: Deep understanding of Elastic Stack capabilities and use cases across deployment, security and operations. Knowledge of distributed cluster architecture at scale, including multi-tenant and CCS environments . Must have's: 6+ years in systems engineering or infrastructure, including 2+ years of production Elastic Stack experience. Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking. Strong problem-solving skills and a self-starter mentality. Solid written and verbal communication skills. Linux Command-Line Interface (CLI) fundamentals and basic networking knowledge. Hands-on experience with containerization and IaC tooling. Proficiency with at least one major cloud provider. Experience with federal security controls (TLS, SSO/SAML, PIV/CAC, STIG). Proven track record leading engagements from scoping through delivery. Deep knowledge of distributed cluster architecture at scale, including multi-tenant and CCS environments. Ability to drive client relationships and identify expansion opportunities. Applicants must currently hold and maintain an active TS/SCI Clearance (Full Scope polygraph preferred). Beneficial to have: Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering or a related field. Elastic certifications (ECE or being on a defined certification track). Elastic Security (SIEM, detection engineering, threat hunting and legacy migration). Detection translation experience (SPL ES QL or equivalent). Scripting proficiency (Python, Bash or PowerShell). Exposure to AI-augmented search, RAG or semantic search use cases. Prior professional services or consulting experience. Where it's done: Onsite (Herndon, VA).
11/12/2026
Full time
Job Description Job Description Who we are: ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a "work hard, play hard" mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community. The Perks: As recognized members of the Cyber Elite, we work together in partnership to defend our nation's critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individual's technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, major carriers for healthcare providers. Highlighted benefits include 144 hours of PTO, 11 holidays, 85% of insurance premiums covered, a 401(k), continuing education, certification maintenance and reimbursement and more. Who we're looking for: We are seeking an Elasticsearch Engineer (TS/SCI Clearance) with expertise in designing, deploying and optimizing Elastic Stack solutions in federal environments. This role supports the delivery of Elastic-based solutions across cloud, on-prem and hybrid infrastructures to enable security operations and data-driven outcomes. The Elasticsearch Engineer will lead technical implementations, support migrations and contribute to scalable architectures while engaging directly with client stakeholders. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market. What you'll be doing: Architect, deploy and tune Elastic Stack solutions (Elastic Cloud Enterprise (ECE), Elastic Cloud on Kubernetes (ECK), Elastic Cloud) across cloud, on-prem and hybrid environments. Execute legacy security platform migrations, including detection translation (e.g., Search Processing Language (SPL) (ES QL) Elasticsearch Query Language) and analyst workflow modernization. Design and implement data ingestion pipelines using Elastic Agent, Fleet, Logstash and Beats. Harden deployments for federal compliance, including Transport Layer Security (TLS), Personal Identity Verification/Common Access Card (PIV/CAC), Single Sign-On (SSO) / Security Assertion Markup Language (SSO/SAML), Security Technical Implementation Guide (STIG) and audit logging. Build outcome-driven dashboards and advanced Kibana visualizations. Develop automation using Infrastructure-as-Code (IaC) tools (Ansible, Terraform or equivalent). Communicate technical decisions and trade-offs directly to client stakeholders. Contribute to internal IP, including reusable templates, automation and reference architectures. What you need to know: Deep understanding of Elastic Stack capabilities and use cases across deployment, security and operations. Knowledge of distributed cluster architecture at scale, including multi-tenant and CCS environments . Must have's: 6+ years in systems engineering or infrastructure, including 2+ years of production Elastic Stack experience. Proven ability to analyze complex requirements and translate them into clear, actionable tasks and processes through critical thinking. Strong problem-solving skills and a self-starter mentality. Solid written and verbal communication skills. Linux Command-Line Interface (CLI) fundamentals and basic networking knowledge. Hands-on experience with containerization and IaC tooling. Proficiency with at least one major cloud provider. Experience with federal security controls (TLS, SSO/SAML, PIV/CAC, STIG). Proven track record leading engagements from scoping through delivery. Deep knowledge of distributed cluster architecture at scale, including multi-tenant and CCS environments. Ability to drive client relationships and identify expansion opportunities. Applicants must currently hold and maintain an active TS/SCI Clearance (Full Scope polygraph preferred). Beneficial to have: Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering or a related field. Elastic certifications (ECE or being on a defined certification track). Elastic Security (SIEM, detection engineering, threat hunting and legacy migration). Detection translation experience (SPL ES QL or equivalent). Scripting proficiency (Python, Bash or PowerShell). Exposure to AI-augmented search, RAG or semantic search use cases. Prior professional services or consulting experience. Where it's done: Onsite (Herndon, VA).
Job Description Job Description SOC Lead / Cybersecurity Operations Lead Project Identifier SC Client South Carolina Agency State of South Carolina Location Fully Onsite (8:00 AM to 5:00 PM) 1801 Main Street, Columbia, SC 29201 Candidate MUST be a SC resident. No relocation allowed. Contract Duration 12 Months Interview Type Virtual Visa Requirements The candidate will have to be on an Innosoft W2. At least 6 months of valid work authorization (Citizen, GC, EAD, OPT-EAD, H4-EAD) Tentative Start Date 12/14/2026 Deadline 11/16/2026 Project Overview This is an ongoing project with aggressive timelines. A majority of the team is made up of experienced consultants, and we are seeking individuals who are highly productive, very flexible, and can work in an environment where fluidity of duties is common. Each team member is expected to contribute with minimal supervision. Candidates who enjoy working on complex, change-oriented projects with motivated team members will find this position attractive. The Office of Cybersecurity is tasked with performing ongoing enterprise cybersecurity threat monitoring and incident response capabilities. This position requires a broad and keen understanding of technology and IT delivery of Security Operation services for on premise and cloud based equipment and critical applications. A strong candidate for this position should possess experience in the following: Cyber Threat Response and Incident Handling Cyber Security Operations Security Service Portfolio Management Duties/Responsibilities: The Cybersecurity Operations Lead will be in a unique position to help mature our Security Operations Center capability and will work directly for the CISO to drive innovation and maturation of the Agency Cyber threat detection and response capabilities. We are looking for candidates who are highly organized, can work independently in a fast-paced environment and produce multiple quality deliverables within defined deadlines. Candidates should be self-starters, creative problem solvers and have an eagerness to implement tactics, techniques and procedures which make the most effective use of Agency staff, resources, products and technologies quickly. Drive innovation and maturation of Security Operations capabilities Act as an escalation point and provide leadership, mentorship, and guidance to SOC Analyst I, II, and III Oversee the identification, analysis, and response to security incidents, ensuring rapid containment and resolution Lead and mentor a team of Security Operations analysts, ensuring they are well-trained and motivated Assist in staffing Security Operations staff Perform threat identification and analysis of risks to the Medicaid Enterprise Assist in the implementation and advancement of Continuous Monitoring and Incident Response processes and procedures Consistently review and refine Playbooks, Process, and Alert reviews to identify areas of improvement Assist with advanced threat hunting, looking for attacker presence within the environment Work with Information Technology, Application Development and Business Teams to advance security efforts of the Medicaid Enterprise Lead security team projects, and continuous improvement Collaborate with compliance teams to maintain audit-ready status Requirements Education and Certifications: BS degree in computer science, information technology, engineering or similar discipline Required Certified Information Systems Security Professional (CISSP) Required GIAC Certified Incident Handler (GCIH) Required Security + Cloud certification (i.e. CASP +) Network security certifications Required Skills: 10+ years of experience of IT working with Windows, Linux, and Web-based applications 5+ years of experience with enterprise infrastructure design and deployment 5 years of related experience in a SOC lead capacity Preferred Skills: Experience identifying, testing and leading remediation efforts of OWASP Top Ten, CWE/SANS TOP 25 Most Dangerous Software Errors, etc. Prior experience performing penetration testing and vulnerability assessments in organizations subject to FISMA or similar requirements Prior experience in working with eGRC systems Additional Skills: Ability to communicate clearly, verbally and in writing; to interact effectively with internal and external vendors, project team members, management and agency departments; to build relationships and use facilitation skills with both technical and non-technical personnel Experience in organizing information in a way that is appropriate for technical explanations without losing sight of the needs and aptitude of the audience Ability to work independently and collaborate with multiple teams and vendors Ability to multitask and prioritize tasks effectively in order to meet deadlines Must be intermediate to advanced skills in additional Microsoft Office products (Word, Excel, PowerPoint, Visio) and working with templates and style guidelines for branding consistency Keen attention to detail while maintaining the ability to see the big picture Experience with the evaluation and selection of products and vendors to support initiatives. Ability to accept changes and constructive criticism in a fast turn-around environment A firm understanding of the offerings and capabilities within Cloud service providers and technologies Benefits Standard Employee Benefits. 50% Health Insurance Paid by Innosoft, Paid Vacation, 401K Match, STD LTD and AD&D paid by Innosoft.
11/11/2026
Full time
Job Description Job Description SOC Lead / Cybersecurity Operations Lead Project Identifier SC Client South Carolina Agency State of South Carolina Location Fully Onsite (8:00 AM to 5:00 PM) 1801 Main Street, Columbia, SC 29201 Candidate MUST be a SC resident. No relocation allowed. Contract Duration 12 Months Interview Type Virtual Visa Requirements The candidate will have to be on an Innosoft W2. At least 6 months of valid work authorization (Citizen, GC, EAD, OPT-EAD, H4-EAD) Tentative Start Date 12/14/2026 Deadline 11/16/2026 Project Overview This is an ongoing project with aggressive timelines. A majority of the team is made up of experienced consultants, and we are seeking individuals who are highly productive, very flexible, and can work in an environment where fluidity of duties is common. Each team member is expected to contribute with minimal supervision. Candidates who enjoy working on complex, change-oriented projects with motivated team members will find this position attractive. The Office of Cybersecurity is tasked with performing ongoing enterprise cybersecurity threat monitoring and incident response capabilities. This position requires a broad and keen understanding of technology and IT delivery of Security Operation services for on premise and cloud based equipment and critical applications. A strong candidate for this position should possess experience in the following: Cyber Threat Response and Incident Handling Cyber Security Operations Security Service Portfolio Management Duties/Responsibilities: The Cybersecurity Operations Lead will be in a unique position to help mature our Security Operations Center capability and will work directly for the CISO to drive innovation and maturation of the Agency Cyber threat detection and response capabilities. We are looking for candidates who are highly organized, can work independently in a fast-paced environment and produce multiple quality deliverables within defined deadlines. Candidates should be self-starters, creative problem solvers and have an eagerness to implement tactics, techniques and procedures which make the most effective use of Agency staff, resources, products and technologies quickly. Drive innovation and maturation of Security Operations capabilities Act as an escalation point and provide leadership, mentorship, and guidance to SOC Analyst I, II, and III Oversee the identification, analysis, and response to security incidents, ensuring rapid containment and resolution Lead and mentor a team of Security Operations analysts, ensuring they are well-trained and motivated Assist in staffing Security Operations staff Perform threat identification and analysis of risks to the Medicaid Enterprise Assist in the implementation and advancement of Continuous Monitoring and Incident Response processes and procedures Consistently review and refine Playbooks, Process, and Alert reviews to identify areas of improvement Assist with advanced threat hunting, looking for attacker presence within the environment Work with Information Technology, Application Development and Business Teams to advance security efforts of the Medicaid Enterprise Lead security team projects, and continuous improvement Collaborate with compliance teams to maintain audit-ready status Requirements Education and Certifications: BS degree in computer science, information technology, engineering or similar discipline Required Certified Information Systems Security Professional (CISSP) Required GIAC Certified Incident Handler (GCIH) Required Security + Cloud certification (i.e. CASP +) Network security certifications Required Skills: 10+ years of experience of IT working with Windows, Linux, and Web-based applications 5+ years of experience with enterprise infrastructure design and deployment 5 years of related experience in a SOC lead capacity Preferred Skills: Experience identifying, testing and leading remediation efforts of OWASP Top Ten, CWE/SANS TOP 25 Most Dangerous Software Errors, etc. Prior experience performing penetration testing and vulnerability assessments in organizations subject to FISMA or similar requirements Prior experience in working with eGRC systems Additional Skills: Ability to communicate clearly, verbally and in writing; to interact effectively with internal and external vendors, project team members, management and agency departments; to build relationships and use facilitation skills with both technical and non-technical personnel Experience in organizing information in a way that is appropriate for technical explanations without losing sight of the needs and aptitude of the audience Ability to work independently and collaborate with multiple teams and vendors Ability to multitask and prioritize tasks effectively in order to meet deadlines Must be intermediate to advanced skills in additional Microsoft Office products (Word, Excel, PowerPoint, Visio) and working with templates and style guidelines for branding consistency Keen attention to detail while maintaining the ability to see the big picture Experience with the evaluation and selection of products and vendors to support initiatives. Ability to accept changes and constructive criticism in a fast turn-around environment A firm understanding of the offerings and capabilities within Cloud service providers and technologies Benefits Standard Employee Benefits. 50% Health Insurance Paid by Innosoft, Paid Vacation, 401K Match, STD LTD and AD&D paid by Innosoft.
Talent Software Services, Inc.
Cayce, South Carolina
Job Description Job Description Job Title: Security Analyst Job Duration: 12 Months Job Location: Blythewood, SC 29016, (Onsite) Interview Type: 1-2 Rounds of Virtual or Onsite Interviews. Candidates are expected to be available for onsite interviews. Shift/Schedule: Working Schedule: Saturday and Sunday evening coverage likely to be 8:00PM-8:00AM (2 12-Hour Shifts) with dayshifts Wednesday and Thursday (8:30 AM - 2:45 PM). Job Summary: Enhance the security posture of the Department of Motor Vehicles to protect sensitive citizen data and ensure the integrity of motor vehicle licensing and titling systems Job Description: The DMV Security Team is looking for candidates to fill an entry level security position. The DMV will train the selected candidate to perform the tasks listed below. At a minimum We are looking for basic server or network administration skills that we can build upon. Threat Intelligence Research Monitor and analyze threat intelligence feeds to identify emerging threats relevant to the organization. Document findings, such as new attack methods or vulnerabilities, and share with the team. Use open-source intelligence (OSINT) tools to gather data on potential risks and adversaries. Threat Hunting and Detection Rule Creation Conduct proactive searches for suspicious behavior in network and endpoint activity using provided tools and playbooks. Utilize threat feeds, investigate suspicious activity, and stay current on cyber threats. Collaborate with senior analysts to refine and test detection rules (e.g., SIEM queries or Defender for Endpoint rules). Document hunting methodologies and findings to support continuous improvement. Log Analysis Review and interpret logs from firewalls, endpoints, and servers to identify indicators of compromise (IOCs). Escalate findings, such as anomalous IP addresses or unauthorized access attempts, to senior analysts. Maintain a log of recurring patterns or anomalies for long-term tracking and analysis. Incident Response Assist in initial triage of security incidents by following response frameworks (e.g., NIST, MITRE Telecommunication&CK). Identify and escalate potential security threats. Gather and analyze relevant evidence, such as logs or alert data, to determine the scope and severity of incidents. Document findings during incidents and contribute to containment and remediation efforts. Documentation, Reporting, and Communication Create clear, detailed reports, including incident reports, after-action reviews, and process documentation. Deliver reports on the security posture and propose mitigation strategies. Draft training materials or guides to help improve organizational awareness and readiness. Regularly update and organize documentation to ensure accuracy and accessibility for team use. Vulnerability Management Analyze reports, prioritize patching, and understand NIST best practices. Security Awareness Training Develop and deliver training and assess employee awareness through simulations. Security Automation and Scripting Leverage SCCM, GPO, and PowerShell for patch deployment. Automate tasks beyond SCCM, GPO, and PowerShell to increase efficiency. Endpoint and Network Security Configure policies, analyze alerts, and manage endpoint protection. Understand network protocols and firewalls to strengthen the overall security posture. Digital Forensics and Cloud Security Investigate security incidents and collect evidence for deeper analysis. Develop knowledge of cloud-specific security solutions as cloud adoption grows Required Skills: Understanding of security concepts and processes Understanding of basic computer and network concepts A High School Diploma is required at minimum Preferred Qualifications: 1 Year of Experience in an IT Security Focused Role Experience with SIEM and Endpoint Security Tools Experience with PowerShell, Group Policy, and Endpoint Management Knowledge of Vulnerability Management and Cloud Security Bachelor's degree in information technology, Computer Science, Cybersecurity, or a related field 1 Years of Experience in Server or Network Administration GIAC Security Essentials (GSEC) Security (CompTIA) Network (CompTIA) GIAC Incident Handler (GCIH)
11/11/2026
Full time
Job Description Job Description Job Title: Security Analyst Job Duration: 12 Months Job Location: Blythewood, SC 29016, (Onsite) Interview Type: 1-2 Rounds of Virtual or Onsite Interviews. Candidates are expected to be available for onsite interviews. Shift/Schedule: Working Schedule: Saturday and Sunday evening coverage likely to be 8:00PM-8:00AM (2 12-Hour Shifts) with dayshifts Wednesday and Thursday (8:30 AM - 2:45 PM). Job Summary: Enhance the security posture of the Department of Motor Vehicles to protect sensitive citizen data and ensure the integrity of motor vehicle licensing and titling systems Job Description: The DMV Security Team is looking for candidates to fill an entry level security position. The DMV will train the selected candidate to perform the tasks listed below. At a minimum We are looking for basic server or network administration skills that we can build upon. Threat Intelligence Research Monitor and analyze threat intelligence feeds to identify emerging threats relevant to the organization. Document findings, such as new attack methods or vulnerabilities, and share with the team. Use open-source intelligence (OSINT) tools to gather data on potential risks and adversaries. Threat Hunting and Detection Rule Creation Conduct proactive searches for suspicious behavior in network and endpoint activity using provided tools and playbooks. Utilize threat feeds, investigate suspicious activity, and stay current on cyber threats. Collaborate with senior analysts to refine and test detection rules (e.g., SIEM queries or Defender for Endpoint rules). Document hunting methodologies and findings to support continuous improvement. Log Analysis Review and interpret logs from firewalls, endpoints, and servers to identify indicators of compromise (IOCs). Escalate findings, such as anomalous IP addresses or unauthorized access attempts, to senior analysts. Maintain a log of recurring patterns or anomalies for long-term tracking and analysis. Incident Response Assist in initial triage of security incidents by following response frameworks (e.g., NIST, MITRE Telecommunication&CK). Identify and escalate potential security threats. Gather and analyze relevant evidence, such as logs or alert data, to determine the scope and severity of incidents. Document findings during incidents and contribute to containment and remediation efforts. Documentation, Reporting, and Communication Create clear, detailed reports, including incident reports, after-action reviews, and process documentation. Deliver reports on the security posture and propose mitigation strategies. Draft training materials or guides to help improve organizational awareness and readiness. Regularly update and organize documentation to ensure accuracy and accessibility for team use. Vulnerability Management Analyze reports, prioritize patching, and understand NIST best practices. Security Awareness Training Develop and deliver training and assess employee awareness through simulations. Security Automation and Scripting Leverage SCCM, GPO, and PowerShell for patch deployment. Automate tasks beyond SCCM, GPO, and PowerShell to increase efficiency. Endpoint and Network Security Configure policies, analyze alerts, and manage endpoint protection. Understand network protocols and firewalls to strengthen the overall security posture. Digital Forensics and Cloud Security Investigate security incidents and collect evidence for deeper analysis. Develop knowledge of cloud-specific security solutions as cloud adoption grows Required Skills: Understanding of security concepts and processes Understanding of basic computer and network concepts A High School Diploma is required at minimum Preferred Qualifications: 1 Year of Experience in an IT Security Focused Role Experience with SIEM and Endpoint Security Tools Experience with PowerShell, Group Policy, and Endpoint Management Knowledge of Vulnerability Management and Cloud Security Bachelor's degree in information technology, Computer Science, Cybersecurity, or a related field 1 Years of Experience in Server or Network Administration GIAC Security Essentials (GSEC) Security (CompTIA) Network (CompTIA) GIAC Incident Handler (GCIH)
Job Title: Cybersecurity Operations Lead - SOC & Incident Response Position Overview Take a leadership role in advancing enterprise cybersecurity operations, strengthening threat detection and response capabilities, and improving Security Operations Center (SOC) maturity. This opportunity involves leading cybersecurity operations initiatives, overseeing incident response activities, mentoring SOC analysts, and implementing continuous improvements across security processes and procedures. The role works closely with IT, application development, business, and compliance teams to strengthen enterprise security capabilities across on-premises and cloud-based environments. The ideal candidate brings extensive IT experience, enterprise infrastructure design and deployment expertise, and a strong background in SOC leadership, cyber threat response, and security operations. What You'll Do / Key Responsibilities Drive innovation and continuous improvement in Security Operations Center capabilities. Serve as an escalation point while providing leadership, mentorship, and guidance to SOC Analyst I, II, and III. Oversee the identification, analysis, and response to security incidents, ensuring rapid containment and resolution. Lead and mentor Security Operations analysts, ensuring they are well-trained and motivated. Assist with staffing Security Operations personnel. Perform threat identification and analyze risks to the enterprise. Assist in implementing and advancing continuous monitoring and incident response processes and procedures. Review and refine security playbooks, processes, and alerts to identify opportunities for improvement. Assist with advanced threat hunting to identify potential attacker presence within the environment. Collaborate with IT, application development, and business teams to advance enterprise security initiatives. Lead security team projects and continuous improvement initiatives. Collaborate with compliance teams to maintain audit-ready status. Required Qualifications 10+ years of IT experience working with Windows, Linux, and web-based applications. 5+ years of experience with enterprise infrastructure design and deployment. 5 years of related experience in a SOC Lead capacity. Must possess any one of the following certifications: Certified Information Systems Security Professional (CISSP). GIAC Certified Incident Handler (GCIH). Security+. Ability to communicate clearly, both verbally and in writing, and interact effectively with internal and external vendors, project team members, management, and technical and non-technical stakeholders. Experience organizing technical information and communicating it appropriately to different audiences. Ability to work independently and collaborate with multiple teams and vendors. Ability to multitask, prioritize tasks, and meet deadlines. Intermediate to advanced skills in Microsoft Office applications, including Word, Excel, PowerPoint, and Visio. Strong attention to detail and ability to maintain a broader organizational perspective. Experience evaluating and selecting products and vendors to support initiatives. Ability to adapt to changes and constructive feedback in a fast-paced environment. Strong understanding of cloud service provider offerings and capabilities. Preferred Qualifications Experience identifying, testing, and leading remediation efforts related to OWASP Top Ten and CWE/SANS Top 25 Most Dangerous Software Errors. Prior experience performing penetration testing and vulnerability assessments in organizations subject to FISMA or similar requirements. Prior experience working with eGRC systems. Bachelor's degree in Computer Science, Information Technology, Engineering, or a similar discipline. Cloud certification (e.g., CASP+). Network security certifications. What Makes HTC A Great Place To Build Your Future HTC Global Services wants you to join our team. Come build new things with us and advance your career. At HTC Global, you'll collaborate with experts, work alongside clients, and be part of high-performing teams driving success together. You'll have long-term opportunities to grow your career and develop skills in the latest emerging technologies. At HTC Global Services, our employees have access to a comprehensive benefits package. Benefits can include Group Health (Medical, Dental, and Vision), Paid Time Off, Paid Holidays, 401(k) matching, Group Life and Disability insurance, Professional Development opportunities, Wellness programs, and a variety of other perks. Our success as a company is built on inclusion and diversity. HTC Global Services is committed to providing a workplace free from discrimination and harassment, where every employee is treated with dignity and respect. We celebrate differences and believe that diverse cultures, perspectives, and skills drive innovation and success. HTC is an Equal Opportunity Employer and a proud National Minority Supplier. We seek to empower each individual, fostering an environment where everyone feels valued, included, and respected.
11/11/2026
Full time
Job Title: Cybersecurity Operations Lead - SOC & Incident Response Position Overview Take a leadership role in advancing enterprise cybersecurity operations, strengthening threat detection and response capabilities, and improving Security Operations Center (SOC) maturity. This opportunity involves leading cybersecurity operations initiatives, overseeing incident response activities, mentoring SOC analysts, and implementing continuous improvements across security processes and procedures. The role works closely with IT, application development, business, and compliance teams to strengthen enterprise security capabilities across on-premises and cloud-based environments. The ideal candidate brings extensive IT experience, enterprise infrastructure design and deployment expertise, and a strong background in SOC leadership, cyber threat response, and security operations. What You'll Do / Key Responsibilities Drive innovation and continuous improvement in Security Operations Center capabilities. Serve as an escalation point while providing leadership, mentorship, and guidance to SOC Analyst I, II, and III. Oversee the identification, analysis, and response to security incidents, ensuring rapid containment and resolution. Lead and mentor Security Operations analysts, ensuring they are well-trained and motivated. Assist with staffing Security Operations personnel. Perform threat identification and analyze risks to the enterprise. Assist in implementing and advancing continuous monitoring and incident response processes and procedures. Review and refine security playbooks, processes, and alerts to identify opportunities for improvement. Assist with advanced threat hunting to identify potential attacker presence within the environment. Collaborate with IT, application development, and business teams to advance enterprise security initiatives. Lead security team projects and continuous improvement initiatives. Collaborate with compliance teams to maintain audit-ready status. Required Qualifications 10+ years of IT experience working with Windows, Linux, and web-based applications. 5+ years of experience with enterprise infrastructure design and deployment. 5 years of related experience in a SOC Lead capacity. Must possess any one of the following certifications: Certified Information Systems Security Professional (CISSP). GIAC Certified Incident Handler (GCIH). Security+. Ability to communicate clearly, both verbally and in writing, and interact effectively with internal and external vendors, project team members, management, and technical and non-technical stakeholders. Experience organizing technical information and communicating it appropriately to different audiences. Ability to work independently and collaborate with multiple teams and vendors. Ability to multitask, prioritize tasks, and meet deadlines. Intermediate to advanced skills in Microsoft Office applications, including Word, Excel, PowerPoint, and Visio. Strong attention to detail and ability to maintain a broader organizational perspective. Experience evaluating and selecting products and vendors to support initiatives. Ability to adapt to changes and constructive feedback in a fast-paced environment. Strong understanding of cloud service provider offerings and capabilities. Preferred Qualifications Experience identifying, testing, and leading remediation efforts related to OWASP Top Ten and CWE/SANS Top 25 Most Dangerous Software Errors. Prior experience performing penetration testing and vulnerability assessments in organizations subject to FISMA or similar requirements. Prior experience working with eGRC systems. Bachelor's degree in Computer Science, Information Technology, Engineering, or a similar discipline. Cloud certification (e.g., CASP+). Network security certifications. What Makes HTC A Great Place To Build Your Future HTC Global Services wants you to join our team. Come build new things with us and advance your career. At HTC Global, you'll collaborate with experts, work alongside clients, and be part of high-performing teams driving success together. You'll have long-term opportunities to grow your career and develop skills in the latest emerging technologies. At HTC Global Services, our employees have access to a comprehensive benefits package. Benefits can include Group Health (Medical, Dental, and Vision), Paid Time Off, Paid Holidays, 401(k) matching, Group Life and Disability insurance, Professional Development opportunities, Wellness programs, and a variety of other perks. Our success as a company is built on inclusion and diversity. HTC Global Services is committed to providing a workplace free from discrimination and harassment, where every employee is treated with dignity and respect. We celebrate differences and believe that diverse cultures, perspectives, and skills drive innovation and success. HTC is an Equal Opportunity Employer and a proud National Minority Supplier. We seek to empower each individual, fostering an environment where everyone feels valued, included, and respected.
Leidos seeks a Cyber Analyst to protect mission-critical systems for government and commercial clients. In this role, you will monitor networks, investigate incidents, and enhance defenses across complex environments. Responsibilities include threat detection, log and SIEM analysis, incident response, and vulnerability remediation in partnership with engineering and operations teams. You will contribute to secure architectures, support compliance requirements, and prepare clear reports for stakeholders, all within a collaborative, mission-driven culture that values innovation and continuous learning. Responsibilities Monitor networks and systems to detect potential cyber threats and anomalies Investigate security incidents and perform root-cause and impact analysis Implement and tune security tools such as SIEM, IDS/IPS, and endpoint protection Develop and maintain incident response procedures and playbooks Collaborate with cross-functional teams to remediate vulnerabilities and improve defenses Produce clear reports, dashboards, and briefings for technical and non-technical stakeholders Assist with threat hunting, intelligence analysis, and proactive risk identification Support compliance with relevant security standards, policies, and regulations Required Skills Security Information and Event Management (SIEM) tools Network security monitoring and analysis Incident response and forensic investigation Intrusion detection/prevention systems (IDS/IPS) Endpoint protection and EDR platforms Vulnerability assessment and remediation Log analysis and correlation Threat intelligence analysis Knowledge of security frameworks (NIST, ISO 27001) Scripting or automation (Python, Power Shell, or similar)
11/08/2026
Full time
Leidos seeks a Cyber Analyst to protect mission-critical systems for government and commercial clients. In this role, you will monitor networks, investigate incidents, and enhance defenses across complex environments. Responsibilities include threat detection, log and SIEM analysis, incident response, and vulnerability remediation in partnership with engineering and operations teams. You will contribute to secure architectures, support compliance requirements, and prepare clear reports for stakeholders, all within a collaborative, mission-driven culture that values innovation and continuous learning. Responsibilities Monitor networks and systems to detect potential cyber threats and anomalies Investigate security incidents and perform root-cause and impact analysis Implement and tune security tools such as SIEM, IDS/IPS, and endpoint protection Develop and maintain incident response procedures and playbooks Collaborate with cross-functional teams to remediate vulnerabilities and improve defenses Produce clear reports, dashboards, and briefings for technical and non-technical stakeholders Assist with threat hunting, intelligence analysis, and proactive risk identification Support compliance with relevant security standards, policies, and regulations Required Skills Security Information and Event Management (SIEM) tools Network security monitoring and analysis Incident response and forensic investigation Intrusion detection/prevention systems (IDS/IPS) Endpoint protection and EDR platforms Vulnerability assessment and remediation Log analysis and correlation Threat intelligence analysis Knowledge of security frameworks (NIST, ISO 27001) Scripting or automation (Python, Power Shell, or similar)
The Senior Insider Threat Hunt Analyst supports the DHS Insider Threat Program by proactively identifying and investigating risky or malicious user behavior. In this on-site role, you will hunt across enterprise data, logs, EDR tools, and network traffic using UAM and UEBA platforms, triage and analyze high-priority alerts, and research behavioral patterns to detect insider threat indicators. You will document findings, brief stakeholders, and recommend mitigation strategies to reduce risk to mission systems and data. Responsibilities Conduct proactive insider threat hunts across DHS networks, logs, EDR tools, and network traffic to detect anomalous user activity. Analyze and correlate insider threat data to identify trends, patterns, and potential risk indicators. Monitor and operate UAM and UEBA platforms, baselining behavior and triaging critical/high alerts within required timeframes. Research and investigate concerning user behaviors, documenting findings and supporting insider threat investigations. Coordinate with security and investigative stakeholders to recommend mitigation strategies that reduce insider threat risk. Support continuous improvement of insider threat detection methodologies, analytics, and hunt processes. Prepare and deliver clear written reports and briefings to diverse technical and non-technical audiences. Collaborate with program teams to identify emerging insider threat requirements and refine monitoring rules and use cases. Required Skills Insider threat hunting User and Entity Behavior Analytics (UEBA) User Activity Monitoring (UAM) tools Cybersecurity monitoring and incident analysis Threat assessment and mitigation methodologies Log and network traffic analysis Intelligence analysis tradecraft Open-source intelligence (OSINT) tools Report writing and analytic briefing Insider Threat frameworks (Pathway to Violence, Critical Pathway)
11/08/2026
Full time
The Senior Insider Threat Hunt Analyst supports the DHS Insider Threat Program by proactively identifying and investigating risky or malicious user behavior. In this on-site role, you will hunt across enterprise data, logs, EDR tools, and network traffic using UAM and UEBA platforms, triage and analyze high-priority alerts, and research behavioral patterns to detect insider threat indicators. You will document findings, brief stakeholders, and recommend mitigation strategies to reduce risk to mission systems and data. Responsibilities Conduct proactive insider threat hunts across DHS networks, logs, EDR tools, and network traffic to detect anomalous user activity. Analyze and correlate insider threat data to identify trends, patterns, and potential risk indicators. Monitor and operate UAM and UEBA platforms, baselining behavior and triaging critical/high alerts within required timeframes. Research and investigate concerning user behaviors, documenting findings and supporting insider threat investigations. Coordinate with security and investigative stakeholders to recommend mitigation strategies that reduce insider threat risk. Support continuous improvement of insider threat detection methodologies, analytics, and hunt processes. Prepare and deliver clear written reports and briefings to diverse technical and non-technical audiences. Collaborate with program teams to identify emerging insider threat requirements and refine monitoring rules and use cases. Required Skills Insider threat hunting User and Entity Behavior Analytics (UEBA) User Activity Monitoring (UAM) tools Cybersecurity monitoring and incident analysis Threat assessment and mitigation methodologies Log and network traffic analysis Intelligence analysis tradecraft Open-source intelligence (OSINT) tools Report writing and analytic briefing Insider Threat frameworks (Pathway to Violence, Critical Pathway)
