Tier 2 Analyst (Secret Cleared)

Who we are:

ShorePoint is a fast-growing, industry-recognized and award-winning cybersecurity services firm focused on high-profile, high-threat public and private sector customers who demand experience and proven security models to protect their data. We embrace a “work hard, play hard” mentality and celebrate individual and company successes. We are passionate about our mission and going above and beyond to deliver for our customers, while fostering an environment that supports creativity, accountability, mission success, critical thinking and a desire to give back to our community.  

The Perks:

As recognized members of the Cyber Elite, we work together in partnership to defend our nation’s critical infrastructure while building meaningful and exciting career development opportunities in a culture tailored to the individual’s technical and professional growth. We are committed to the belief that our team members do their best work when they are happy and well cared for. In support of this philosophy, we offer a comprehensive benefits package, major carriers for healthcare providers. Highlighted benefits include 144 hours of PTO, 11 holidays, 85% of insurance premiums covered, a 401(k), continuing education, certification maintenance and reimbursement and more.

Who we’re looking for:

We are seeking a Tier 2 Analyst (Secret Clearance) to support the enterprise Security Operations Center (SOC) by reviewing and responding to escalated tickets from Tier 1. This role applies working knowledge of cybersecurity to improve incident detection, analyze threat intelligence and support both classified and unclassified environments. The Tier 2 Analyst position requires the ability to work under limited supervision while applying technical expertise to moderately complex problems. This is a unique opportunity to shape the growth, development and culture of an exciting and fast-growing company in the cybersecurity market.

What you’ll be doing:

• Investigate Tier 1 escalations using retrospective analysis to determine the scope and impact of potential incidents.
• Correlate Security Information and Event Management (SIEM) data, Endpoint Detection and Response (EDR) telemetry, and threat intelligence to establish who, what, where, when, and how.
• Recommend and execute containment actions, including host isolation and Indicator of Compromise (IOC) blocking, as directed by the government.
• Prepare incident analysis reports and maintain complete incident tickets through closure.
• Identify false-positive patterns and recommend correlation rule tuning to improve detection accuracy.

What you need to know:

• Incident response lifecycle and federal reporting requirements, including National Institute of Standards and Technology (NIST) and Committee on National Security Systems (CNSS) guidance.
• Log analysis, network-based, and host-based investigation techniques.
• Application of Cyber Threat Intelligence (CTI) and the MITRE ATT&CK framework to active investigations.
• Security operations across unclassified and classified environments.

Must have’s:

• Bachelor’s degree or 3+ additional years of relevant experience in lieu of degree.
• 3+ years of relevant experience.
• Hands-on investigation experience with Splunk and FireEye Endpoint Security (HX), supported by a solid understanding of SIEM and EDR technologies regardless of vendor.
• Demonstrated critical thinking skills to break down complex, ambiguous problems into actionable tasks and determine appropriate courses of action.
• Ability to work rotating shifts and provide on-call support in a 24x7x365 SOC environment.
• Applicants must currently hold and maintain an active Secret clearance.

Beneficial to have:

• One or more of the following certifications: GIAC Certified Incident Handler (GCIH), CompTIA CySA+ or a comparable certification.
• Microsoft Defender or dynamic malware analysis experience.

Where it’s done:

• Onsite (Washington, DC).