SBA - Cyber Defense Analyst

About the Role

The day-to-day responsibilities of this role will involve working closely with SOC personnel, incident responders, engineers, system administrators, and government stakeholders to strengthen the agency's security posture. You will be required to perform proactive monitoring, analysis, detection, triage, investigation, containment, and reporting of cybersecurity incidents and anomalous events.

The SBA's cybersecurity mission is a 24x7x365 operation, and as a Cyber Defense Analyst, you will be expected to work collaboratively with the team to ensure seamless coverage and support.

What You Will Do

• Perform cybersecurity monitoring, incident detection, triage, analysis, and response activities in support of SBA SOC operations
• Support 24x7x365 SOC operations in accordance with SBA ECS Task Area 3.5.3 requirements
• Monitor security alerts and analyze network, endpoint, system, cloud, and application activity for indicators of compromise
• Investigate cybersecurity incidents and suspicious events utilizing SIEM, EDR, IDS/IPS, firewall, and threat intelligence platforms
• Support incident response activities in accordance with SBA ECS Task Area 3.5.3.3 and NIST SP 800-61 guidance
• Create, update, and manage cybersecurity incident tickets, case files, reports, and escalation documentation
• Perform log analysis and event correlation using multiple security monitoring platforms and data sources
• Assist with threat hunting activities to identify malicious or anomalous activity across enterprise environments
• Analyze phishing attempts, malware activity, unauthorized access attempts, and suspicious user behavior
• Support containment, eradication, remediation, and recovery activities during cybersecurity incidents

What We Are Looking For

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Assurance, or related technical discipline
• Minimum of 5 years of cybersecurity operations, SOC analysis, cyber defense, or incident response experience
• Experience supporting enterprise SOC operations, cybersecurity monitoring, and incident response activities
• Experience with SIEM, EDR, IDS/IPS, vulnerability management, and network security monitoring tools
• Knowledge of incident response methodologies, threat analysis, and cybersecurity operations concepts
• Experience analyzing logs, alerts, indicators of compromise, and security event data
• Understanding of federal cybersecurity frameworks including NIST SP 800-53 and NIST SP 800-61
• Experience supporting cloud security operations in Azure, AWS, Microsoft 365, and SaaS platforms

Nice to Have

• Experience with threat intelligence platforms and tools
• Knowledge of cloud security architecture and design patterns
• Experience with automation tools such as Ansible or Python
• Certification in CompTIA Security+, CISSP, or CEH

Benefits and Perks

• Competitive salary and benefits package
• Opportunity to work on high-impact projects with a talented team
• Professional development and training opportunities
• Flexible work arrangements and remote work options
• Access to cutting-edge technologies and tools
• Collaborative and dynamic work environment
• Recognition and reward for outstanding performance

• To stand out as a candidate, highlight your experience with SIEM, EDR, and threat intelligence platforms.
• Make sure to review the NIST SP 800-53 and NIST SP 800-61 frameworks before applying.
• Practice your log analysis and event correlation skills to demonstrate your expertise.
• Be prepared to discuss your experience with incident response and threat hunting activities.
• Showcasing your ability to work collaboratively in a team environment will be beneficial.
• Research the company culture and values to demonstrate your fit with the organization.
• Prepare questions to ask the interviewer about the role, team, and company to show your interest and engagement.