Cyber Security Analyst

VAE, Inc. is a full-service IT infrastructure solutions company focused on building, securing, and supporting mission-critical enterprises. The Cyber Security Analyst will support a C5ISR contract in a fully remote role by monitoring, detecting, analyzing, and responding to threats against DoD networks and systems, while conducting threat hunting, incident response, detection engineering, and forensic analysis.

Responsibilities:

• Monitor, triage, and analyze security events and alerts across SIEM, IDS/IPS, HIDS/NIDS, EDR, firewall, and proxy data sources to identify malicious activity and intrusion attempts
• Conduct proactive, hypothesis-driven threat hunting to identify adversary tactics, techniques, and procedures (TTPs) not detected by existing controls, leveraging the MITRE ATT&CK framework
• Engineer, test, and tune cross-platform detection content (e.g., Sigma, SIEM correlation rules, IDS signatures) to improve detection fidelity and reduce false positives
• Perform incident response and incident handling activities, including containment recommendations, root cause analysis, and post-incident reporting
• Perform network traffic and packet analysis, log analysis, and malware analysis to characterize threats and determine scope and impact
• Conduct digital forensic analysis while preserving chain of custody and documenting findings to evidentiary standards
• Develop and maintain Courses of Action (COAs), playbooks, and standard operating procedures to streamline SOC workflows and reduce response times
• Identify and support opportunities for security automation and process improvement within SOC operations
• Support vulnerability management and Risk Management Framework (RMF) compliance activities, including assessment of findings and remediation tracking
• Prepare technical briefings, incident reports, and periodic threat trend reports for government leadership and program stakeholders
• Mentor junior analysts on detection, analysis, reporting, and emerging threats and technologies
• Collaborate with cross-functional engineering, network, and mission partner teams to strengthen the overall security posture of supported environments

Requirements:

• Active TS/SCI security clearance
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field; additional years of relevant experience may be considered in lieu of a degree
• 7+ years of cybersecurity experience, including at least 5 years in a SOC, incident response, or defensive cyber operations role
• DoD 8140/8570 IAT Level II certification or higher (e.g., Security+ CE, CySA+, GSEC, CISSP) at time of hire
• Hands-on experience with SIEM platforms (e.g., Splunk, Elastic, ArcSight, Microsoft Sentinel) and enterprise security tools such as IDS/IPS, EDR, firewalls, and proxies
• Strong knowledge of network protocols, ports, and traffic analysis, with experience using packet analyzers (e.g., Wireshark, Zeek, tcpdump)
• Experience with threat hunting and working knowledge of the MITRE ATT&CK framework
• Experience performing incident handling and digital forensics, including evidence handling and chain of custody
• Familiarity with DoD cybersecurity policies and compliance frameworks, including RMF and FISMA
• Excellent written and verbal communication skills, with the ability to translate complex technical threats into clear, actionable recommendations for technical and non-technical audiences
• Ability to work independently and collaborate effectively in a 100% remote environment