Senior SOC Analyst

Everforth ECS is seeking a Senior SOC Analyst to work in a hybrid capacity at our Fairfax, VA office.

The Senior SOC Analyst will play a key part in standing up and operating the program’s Security Operations Center (SOC), including security monitoring, threat hunting, incident analysis, incident response, and SIEM development. This individual will help build the SOC capability from the ground up and will serve as the primary hands-on SOC resource.

The ideal candidate is a highly technical cybersecurity professional who can independently investigate complex alerts and anomalous activity, determine whether events represent legitimate security incidents, and drive confirmed incidents through the full response lifecycle. The Senior SOC Analyst will also help improve detection coverage, incident response processes, documentation, and overall SOC capabilities. The Senior SOC Analyst reports to the Senior Information System Security Manager.

Job Responsibilities:

• Serve as the primary SOC resource for a new unclassified AWS environment.
• Build, configure, tune, and continuously improve SIEM queries, correlation rules, alerts, dashboards, reports, and detection content.
• Monitor and investigate security alerts, notable events, IoCs, and anomalous activity to determine whether activity is an explained anomaly or a potential cybersecurity incident.
• Own confirmed cybersecurity incidents from detection through closure, ensuring incident tickets, timelines, findings, response actions, and supporting evidence remain accurate and complete.
• Perform advanced analysis using endpoint, network, identity, cloud, application, operating system, and other available security telemetry to determine scope, impact, attack vector, and root cause.
• Coordinate incident response activities with cybersecurity, cloud, network, system administration, application, and other technical teams and ensure participating teams document required actions and evidence.
• Ensure incident response activities address detection, analysis, containment, eradication, recovery, and post-incident review.
• Analyze and correlate IoCs, CVEs, threat intelligence, malicious infrastructure, and adversary Tactics, Techniques, and Procedures (TTPs) to determine potential impact and develop appropriate detections, threat hunts, and defensive actions.
• Apply frameworks such as MITRE ATT&CK to support investigations, detection development, and proactive threat hunting.
• Tune detection logic to improve coverage, identify gaps, and reduce false positives.
• Develop and maintain SOC SOPs, incident runbooks, escalation procedures, and other supporting operational documentation.
• Identify opportunities to automate alert enrichment, event correlation, investigation workflows, ticketing, and SOC reporting.
• Develop SOC metrics and reporting to communicate alert trends, incident activity, response performance, and identified security gaps.
• Lead post-incident After Action Reports (AARs), documenting the incident timeline, response activities, lessons learned, root cause, and recommended improvements to detections, controls, and response procedures.
• Mentor junior analysts and provide technical guidance during investigations and incident response activities.
• Continuously evaluate and improve SOC monitoring, detection, investigation, and incident response capabilities.
• Other duties, as assigned.

Salary: $130,000-150,000

General Description of Benefits