Cyber Security / SOC Analyst (Weekend Nights)

phia, LLC provides cyber intelligence, cybersecurity, and cyber operations support services to government and commercial clients. The Cyber Operations Analyst will support 24x7 Cyber Security Operations Center operations through advanced threat monitoring, incident analysis and management, threat intelligence, and intrusion analysis. The role also leverages AI/ML, automation, and SOAR capabilities to improve SOC efficiency and security posture.

Responsibilities:

• Support 24x7 monitoring, detection, and management of advanced cyber threats
• Execute operational processes in support of response efforts to identified security incidents
• Perform deep-dive incident analysis by correlating data from multiple sources to determine impact on critical systems or datasets
• Interpret output from the SIEM, incident reporting platforms and mailboxes, and phone calls to identify potential security incidents
• Handle incidents as defined in Playbooks and SOPs
• Identify security problems which may require mitigating controls, and advise on remediation actions
• Analyze threat intelligence to assess risk and adapt defenses
• Provide subject matter expertise on network-based attacks, intrusion methodologies, and threat management
• Escalate complex incidents for further investigation and collaborate with other Threat Management team members
• Utilize AI/ML-based tools to detect anomalies, automate triage, and improve threat intelligence
• Provide input and analysis on how to leverage Artificial Intelligence, Machine Learning, and SOAR capabilities to improve CSOC efficiency and accuracy
• Stay current on cybersecurity trends, threat actors, and AI/ML advancements relevant to SOC operations
• Tune security policies, maintain visibility into cloud and endpoint environments, and support continuous improvement of the organization’s security posture
• Identify and support automation use cases, including the use of AI/ML to enhance SOC capabilities
• Collaborate across the larger organization to provide SOC enhancement capabilities through the use of automation and AI

Requirements:

• Qualified candidates will be U.S. Citizens
• able to achieve Public Trust security vetting approval
• Experienced in cyber/IT security with at least 3 years of experience in IT and/or SOC operations
• Familiar with both command and sophisticated threat actor tools and techniques
• Skilled in network traffic analysis and threat detection methodologies
• Strong understanding of Boolean logic, TCP/IP fundamentals, network-level exploits, and IDS/IPS technologies and signature development & optimization
• Familiar with IT control frameworks, risk management techniques, and cloud security (AWS, Azure, GCP)
• Hands-on experience with cybersecurity automation and SIEM/SOAR platforms
• Proficient in using ML frameworks for anomaly detection, threat intelligence, and behavioral analysis
• Skills in data analysis and feature engineering, with the ability to process and transform large datasets from various sources (e.g., logs, network traffic) to extract relevant features for machine learning models aimed at identifying security incidents and vulnerabilities
• Familiarity with the application of AI/ML techniques in cybersecurity, including but not limited to automated threat detection, incident response automation, and predictive analytics
• Excellent communication, organizational, and interpersonal skills
• BA/BS in Computer Science, IT, or related field (or equivalent experience) with 3+ years of direct experience in cybersecurity and SOC analysis & operations
• 7+ years of experience in cybersecurity and IT and SOC analysis & operations
• U.S. Citizenship required
• Ability to obtain Public Trust clearance
• Experience with Splunk, ProofPoint, Cisco FirePower, SentinelOne, Microsoft Defender Microsoft Defender for Cloud Apps, Defender for Endpoint, Defender XDR, Defender for Office 365, Azure Entra ID, and Google Cloud Security Command Center (SCC)
• Expertise with IDS/IPS architectures, signature creation, and anomaly-based detection
• Strong data analysis and feature engineering skills for ML-based security models
• Direct experience with AI/ML applications in SOC environments, including automated threat detection and predictive analytics