Job Title: SOC Analyst Tier 3

Place of Performance: Springfield, VA

Experience Level: 5-8 years of experience

About JFL Consulting:

With more than 20 years of securing some of the U.S. Department of Defense and the Intelligence Community’s most critical networks, JFL Consulting, LLC provides advanced network security solutions to a range of US Government and US commercial clients.

Our cybersecurity operators are experts at assessing and defending mission-critical data and the networks that facilitate their operation. We are focused on delivering advanced products and industry best practices that meet each customer’s unique requirements. Visit www.jflconsulting.com

What We Offer:

Salary: $140k- $180k
100% employer-paid medical, dental, and vision premiums for employees and dependents
Flexible Spending Accounts (healthcare, dependent care, and commuter)
Life insurance, short-term disability and long-term disability
401(k) with immediate vesting of company contribution
Generous PTO policy (15 vacation, 5 sick, 2 personal days, 11 holidays)
We support your growth through certification reimbursement, dedicated professional development funding, and company-provided access to online learning platforms

Job Overview:

We're looking for a SOC Analyst Tier 3 and Incident Responder, a senior analyst role in the SOC. This role leads the response to confirmed security incidents, conducts threat hunting operations, and provides deep technical analysis capability in the operations center. Tier 3/IR analysts are activated for severe incidents and are the primary interface to the Tier 4 SME and external response resources when needed.

Key Responsibilities:

Provide Tier 3 escalation and resolution for the most complex incidents and outages escalating to the Tier 4 SME as needed with appropriate documentation
Lead the response to Priority 1 and complex Priority 2 security incidents from detection through remediation
Conduct proactive threat hunting operations to identify threats that have bypassed automated detection
Perform advanced PCAP analysis, log analysis, memory forensics, and malware triage
Contain and eradicate threats while coordinating with engineers for isolation and remediation
Produce formal incident response reports for Priority 1 and Priority 2 incidents
Develop and maintain threat hunting TTPs and playbooks
Build new detection use cases from threat hunting findings and submit to SIEM engineer
Serve as on-call incident responder
Brief senior leadership during active high priority incidents
Mentor Tier 1 and 2 analysts in investigation techniques and escalation decision-making
Manage and own the SOC Event log for all events during the shifts
Maintain situational awareness of the threat landscape and active campaigns
Participate briefings and training sessions

Required Qualifications:

5+ years of SOC, threat hunting or incident response type experience
Bachelor's degree in Cyber Security, Information Technology, Computer Science, Information Security, or related field. In lieu of degree, four additional years of experience in a NOC, SOC, IT security, or network engineering role
Two of the following certifications, equivalent or better: Sec+, CYSA+, GCIH, SecX, CEH, GCIA, GSOC, CISSP
Demonstrated hands-on incident response experience including containment, eradication, and recovery
Proficiency with SIEM platforms and log analysis
Proficiency with SIEM query languages — SPL, KQL, or equivalent
Proficiency with PCAP analysis tools (Wireshark, NetworkMiner, or equivalent)
Experience with EDR, endpoint forensics, memory analysis, and network forensics tools
Deep understanding of attacker TTPs, kill chain methodology, and MITRE ATT&CK
Ability to work shifts including nights, weekends, and holidays on rotating shift schedule

Preferred Qualifications

GCFA or GCFE certification or other forensic certifications
Active Secret clearance preferred but not required
Experience with threat hunting frameworks and platforms
Reverse engineering experience (IDA Pro, Ghidra)
Prior experience on a DFIR team or incident response retainer
Experience with malware analysis (static and dynamic)

JFL Consulting, LLC is an Equal Opportunity Employer.

We do not discriminate against any applicant for employment on any legally recognized basis including, but not limited to: race, religion or creed, color, national origin, sex, age, disability, marital status, sexual orientation, genetic information, veteran status, status with regard to public assistance or any other protected class under federal, state or local statute. It is also the policy of JFL Consulting, LLC to provide reasonable accommodations for qualified individuals with disabilities.

PI286055665

JFL Consulting LLC

New Jobs

SOC Analyst Tier 3