The Cyber Defense Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) Security Operations Center (SOC) by providing cybersecurity monitoring, incident response, threat analysis, and cyber defense operations in support of the agency’s 24x7x365 cybersecurity mission. The Cyber Defense Analyst performs proactive monitoring, analysis, detection, triage, investigation, containment, and reporting of cybersecurity incidents and anomalous events across enterprise, cloud, and hybrid environments. The position works closely with SOC personnel, incident responders, engineers, system administrators, and Government stakeholders to strengthen the agency’s security posture and ensure rapid identification and mitigation of cyber threats.
Essential Duties and Responsibilities
Perform cybersecurity monitoring, incident detection, triage, analysis, and response activities in support of SBA SOC operations.
Support 24x7x365 SOC operations in accordance with SBA ECS Task Area 3.5.3 requirements.
Monitor security alerts and analyze network, endpoint, system, cloud, and application activity for indicators of compromise.
Investigate cybersecurity incidents and suspicious events utilizing SIEM, EDR, IDS/IPS, firewall, and threat intelligence platforms.
Support incident response activities in accordance with SBA ECS Task Area 3.5.3.3 and NIST SP 800-61 guidance.
Create, update, and manage cybersecurity incident tickets, case files, reports, and escalation documentation.
Perform log analysis and event correlation using multiple security monitoring platforms and data sources.
Assist with threat hunting activities to identify malicious or anomalous activity across enterprise environments.
Analyze phishing attempts, malware activity, unauthorized access attempts, and suspicious user behavior.
Support containment, eradication, remediation, and recovery activities during cybersecurity incidents.
Document incident findings, response actions, lessons learned, and operational recommendations.
Escalate incidents to senior analysts, incident responders, or Government leadership based on severity and impact.
Support vulnerability management coordination and remediation tracking activities.
Assist with forensic evidence collection and preservation activities as directed.
Provide operational support for cloud environments including Microsoft Azure, AWS, Microsoft 365, and SaaS platforms.
Participate in SOC shift turnover briefings, operational reporting, and incident coordination meetings.
Support cybersecurity exercises, continuity of operations (COOP) activities, and readiness initiatives.
Maintain compliance with federal cybersecurity standards, policies, procedures, and reporting requirements.
Collaborate with internal and external stakeholders to support incident response and operational security objectives.
Minimum Qualifications
Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Assurance, or related technical discipline. Relevant experience may substitute for education requirements.
Minimum of 5 years of cybersecurity operations, SOC analysis, cyber defense, or incident response experience.
