Cyber Defense Analyst (Tier 1) - Overnight

Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers’ most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.

Location: Remote

1.0    Role Description

The Cyber Defense Analyst is responsible for monitoring, triaging, and providing first response to security alerts across VSOC customer environments, using various security tools to distinguish meaningful threats from background noise while carefully documenting investigations and analyzing events for signs of true positive threats. They work closely with fellow analysts, sharing findings and leveraging senior colleagues’ expertise to deepen their analysis, determine the appropriate severity of each situation, and promptly escalate issues to the right stakeholders. At the end of each shift, they clearly communicate outstanding items and tasks to the incoming team to ensure continuity of operations and effective SOC performance.

Responsibilities

1.1      Primary Responsibilities

Protect and Defend:

·         Monitor Customer Environments - Leverage the customer's security technologies to triage security alerts and identify potential threats.

·         Escalate confirmed or suspected Threats - Compile an actionable report that describes a threat to the customer environment and escalate through the appropriate channels.

·         Document Investigations - Record security investigation efforts in a thorough manner that allows for easy peer review and collaboration through the appropriate case management tool.

Incident Response:

·         Execute standard operating procedures (SOPs) for common alert types

·         Perform basic artifact analysis (IP addresses, domains, file hashes)

·         Conduct initial containment actions (isolating hosts, blocking IPs) per runbooks

·         Document all actions taken with timestamps and evidence preservation

Communicate and Collaborate:

·         Acknowledge and handle Customer Requests - Process communications from assigned customers and fulfill (or forward) the tasks as appropriate.

·         Support your Shift - Be available to your teammates while on shift and ready to assist them at all times.

·         Improve SOC Situational Awareness - Use the Shift Turnover Report to note outstanding work items, tasks and situations that the following shifts should be aware of.

1.2      Secondary Responsibilities

Maintain SOC Readiness:

·         Verify and Improve Customer Access - Take responsibility of your overall access situation and work with the Program Managers to achieve 100% access across all customers.

·         Identify and Fill knowledge gaps - Convert localized tribal knowledge into global shared knowledge through SharePoint articles and documents for the entire SOC to benefit from.

·         Update outdated documentation - Take stock of currently existing documentation and change the information as necessary to keep the knowledge base current.

Continuous Development:

·         Keep up-to-date on Threat Landscape - Review Threat Intelligence's weekly Cyber Threat Reports and crawl the open web to learn about contemporary threats to our environments.

·         Hone Blue Team skills - Seek out challenges and trainings to improve your Analysis skillset.

·         Get Creative - Take a proactive approach to problems encountered in your career and consider possible solutions you or the team can implement to overcome them.

2.0    Role Integrations

2.1      Collaboration with the Intelligence Team

Purpose

The Intelligence team provides the Tier 1 Cyber Security Analyst situational updates on the ever-changing Cyber Threat Landscape regularly. T1 Analyst should seek to leverage the knowledge provided to improve their contextual awareness for threats in their daily monitoring duties.

Requirements

·         Stay Appraised: Attend weekly Threat Intelligence briefings (or download the recording/slides of the briefings) regularly to stay up-to-date on the latest changes to the Cyber Threat Landscape.

·         Feedback Loop: Provide feedback to the intelligence team on the effectiveness and accuracy of the threat intelligence reports received. Share insights and observations from working with the threat hunting content and highlight any areas where additional or more specific information would be beneficial for improving the content's accuracy and relevance.

2.2      Collaboration with the Program Management Team

Purpose

The Program Management team handles the majority of the VSOC’s administrative duties for our customer environments. Tier 1 Cyber Security Analysts should leverage the PM team to gain further insight into what their customer environments need from them as well for handling clerical tasks (such as requesting access for customer tools)

Requirements

·         Regular Communication: Request for the Program Management team must be documented in our case management system and frequently followed-up on in order to maintain momentum and prevent important tasks from falling off the PM’s radar.

·         Self-Accountability (Access : Customer access is a core requirement of the T1 Analysts role in the VSOC and often takes time to restore once lost. VSOC Analysts must regularly verify and maintain their access to prevent long periods of downtime as the result of access loss.

2.3      Collaboration with the Customer Tech Leads

Purpose

Customer Technology Leads (formerly known as Client Leads) serve as the operational SME of a customer environment. Cyber Defense Analysts will interface with these leads in order to address environmental concerns (such alert tuning or customer requests).

Requirements

·         Regular Communication: T1 Analysts who are assigned to customer environments should be aware of who the relevant Customer Tech Leads are and be ready to open lines of communication with them to raise concerns or ask questions to help them on their Threat Monitoring duties.

·         Identify Tuning Opportunities: Many alerts worked by T1 Analysts often result in false positive/benign results that generate unnecessary noise in a customer environment. T1 Analysts should help mitigate the noise by identifying these noisy alerts and informing the Customer Tech Lead of tuning opportunities through Tuning Requests.

2.4      Collaboration with the Engineering Team

Purpose

The Engineering team maintains the availability of the majority of the VSOC’s customer environments. Cyber Defense Analysts interface with technologies that Engineering teams maintain and relay any issues in availability and performance so that Engineering can resolve them in a timely manner.

Requirements

·         Regular Communication: T1 Analysts who are assigned to customer environments should be aware of who the relevant Engineers are and be ready to open lines of communication with them to raise issues that impact system availability or performance.

Identify Tuning Opportunities: Many alerts worked by T1 Analysts often result in false positive/benign results that generate unnecessary noise in a customer environment.

3.0    Qualifications

3.1      Mandatory Requirements

3.1.1     Experience

·         1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC/NOC or similar environment.

·         Hands-on experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage.

·         Experience using endpoint detection and response (EDR) tools for basic investigation and containment.

·         Practical experience triaging alerts, performing basic artifact analysis, and escalating incidents.

·         Exposure to incident response activities (initial containment, documentation, coordination with senior analysts).

·         Experience working in a 24x7 or shift-based operational environment.

·         Experience documenting investigations and maintaining accurate tickets/case records.

3.1.2     Technical Skills

·         Solid understanding of network protocols and architecture (TCP/IP, DNS, HTTP/S, VPNs, common ports/services).

·         Proficiency in basic log analysis and event correlation across multiple data sources (endpoint, network, identity, cloud).

·         Familiarity with major threat frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain) and their practical application.

·         Working knowledge of Windows and Linux operating systems from a security and operations perspective.

·         Familiarity with at least one major cloud environment (Azure, AWS, or GCP) and its core security concepts.

·         Ability to execute SOPs and runbooks for common alert types and initial containment (host isolation, blocking IPs/domains).

·         Ability to perform basic artifact analysis (IP addresses, domains, URLs, file hashes, simple email header review).

·         Comfortable using case management and collaboration tools to track and share investigation details.

3.1.3     Key Competencies

·         Proactive and self-motivated approach to monitoring, investigation, and continuous improvement.

·         Strong analytical and problem-solving skills applied to alert triage and incident assessment.

·         High attention to detail and accuracy in documentation, evidence handling, and severity assessment.

·         Excellent written communication skills for clear, concise tickets, incident notes, and handover reports.

·         Effective verbal communication skills for collaboration with teammates and cross-functional partners.

·         Ability to work under pressure during active security incidents while maintaining composure and quality.

·         Team-oriented mindset with strong collaboration and knowledge-sharing habits.

·         Continuous learning attitude, staying current with evolving threats, tools, and best practices.

·         At least one entry-level cybersecurity certification (e.g., CompTIA Security+, ISC2 CC, or equivalent).

3.2      Preferred Qualifications

·         2–4+ years of direct SOC, incident response, or security monitoring experience.

·         Advanced experience with Microsoft Sentinel and/or Microsoft security stack (Defender, M365, Entra ID).

·         Hands-on experience supporting or leading incident response for medium to high-severity events.

·         Exposure to cloud security monitoring and hardening (Azure, AWS, or GCP).

·         Experience tuning SIEM/EDR alerts and creating or refining detection use cases.

·         Familiarity with scripting or automation (Python, PowerShell, KQL, Bash) to support investigations.

·         Experience working in client-facing or consulting environments.

·         Prior involvement in SOC process improvements, documentation, or automation initiatives.

One or more intermediate certifications (e.g., CySA+, GSEC, GCIH, CISSP Associate, or equivalent).

Salary & Benefits

The salary associated with this position ($64,000-$128,000) is commensurate with the selected candidate’s qualifications, years of relevant experience, and demonstrated level of expertise. Compensation will be determined based on these factors to ensure alignment with skills, responsibilities, and market standards.

Nightwing offers medical, vision and dental insurance coverage in addition to a 401k plan, PTO, Holidays, and additional insurances.

Nightwing is An Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class.