Tier 2 Analyst (Secret Cleared)

Summary

Tier 2 Analyst (Secret Clearance)

ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a "work hard, play hard" mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community.

We are seeking a Tier 2 Analyst (Secret Clearance) to support the enterprise Security Operations Center (SOC) by reviewing and responding to escalated tickets from Tier 1. This role applies working knowledge of cybersecurity to improve incident detection, analyze threat intelligence and support both classified and unclassified environments. The Tier 2 Analyst position requires the ability to work under limited supervision while applying technical expertise to moderately complex problems. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.

Investigate Tier 1 escalations using retrospective analysis to determine the scope and impact of potential incidents.

Correlate Security Information and Event Management (SIEM) data, Endpoint Detection and Response (EDR) telemetry, and threat intelligence to establish who, what, where, when, and how.

Recommend and execute containment actions, including host isolation and Indicator of Compromise (IOC) blocking, as directed by the government.

Prepare incident analysis reports and maintain complete incident tickets through closure.

Identify false-positive patterns and recommend correlation rule tuning to improve detection accuracy.

Incident response lifecycle and federal reporting requirements, including National Institute of Standards and Technology (NIST) and Committee on National Security Systems (CNSS) guidance.

Log analysis, network-based, and host-based investigation techniques.

Application of Cyber Threat Intelligence (CTI) and the MITRE ATT&CK framework to active investigations.

Security operations across unclassified and classified environments.

Bachelor's degree or 3+ additional years of relevant experience in lieu of degree.

3+ years of relevant experience.

Hands-on investigation experience with Splunk and FireEye Endpoint Security (HX), supported by a solid understanding of SIEM and EDR technologies regardless of vendor.

Demonstrated critical thinking skills to break down complex, ambiguous problems into actionable tasks and determine appropriate courses of action.

Ability to work rotating shifts and provide on-call support in a 24x7x365 SOC environment.

Applicants must currently hold and maintain an active Secret clearance.

One or more of the following certifications: GIAC Certified Incident Handler (GCIH), CompTIA CySA+ or a comparable certification.

Microsoft Defender or dynamic malware analysis experience.

Onsite (Washington, DC).

Job Description

Tier 2 Analyst (Secret Clearance)

ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a "work hard, play hard" mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community.

We are seeking a Tier 2 Analyst (Secret Clearance) to support the enterprise Security Operations Center (SOC) by reviewing and responding to escalated tickets from Tier 1. This role applies working knowledge of cybersecurity to improve incident detection, analyze threat intelligence and support both classified and unclassified environments. The Tier 2 Analyst position requires the ability to work under limited supervision while applying technical expertise to moderately complex problems. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.

Investigate Tier 1 escalations using retrospective analysis to determine the scope and impact of potential incidents.

Correlate Security Information and Event Management (SIEM) data, Endpoint Detection and Response (EDR) telemetry, and threat intelligence to establish who, what, where, when, and how.

Recommend and execute containment actions, including host isolation and Indicator of Compromise (IOC) blocking, as directed by the government.

Prepare incident analysis reports and maintain complete incident tickets through closure.

Identify false-positive patterns and recommend correlation rule tuning to improve detection accuracy.

Incident response lifecycle and federal reporting requirements, including National Institute of Standards and Technology (NIST) and Committee on National Security Systems (CNSS) guidance.

Log analysis, network-based, and host-based investigation techniques.

Application of Cyber Threat Intelligence (CTI) and the MITRE ATT&CK framework to active investigations.

Security operations across unclassified and classified environments.

Bachelor's degree or 3+ additional years of relevant experience in lieu of degree.

3+ years of relevant experience.

Hands-on investigation experience with Splunk and FireEye Endpoint Security (HX), supported by a solid understanding of SIEM and EDR technologies regardless of vendor.

Demonstrated critical thinking skills to break down complex, ambiguous problems into actionable tasks and determine appropriate courses of action.

Ability to work rotating shifts and provide on-call support in a 24x7x365 SOC environment.

Applicants must currently hold and maintain an active Secret clearance.

One or more of the following certifications: GIAC Certified Incident Handler (GCIH), CompTIA CySA+ or a comparable certification.

Microsoft Defender or dynamic malware analysis experience.

Onsite (Washington, DC).