[Hiring] Cyber Defense Analyst @Nightwing

Role Description

The Cyber Defense Analyst is responsible for monitoring, triaging, and providing first response to security alerts across VSOC customer environments, using various security tools to distinguish meaningful threats from background noise while carefully documenting investigations and analyzing events for signs of true positive threats. They work closely with fellow analysts, sharing findings and leveraging senior colleagues’ expertise to deepen their analysis, determine the appropriate severity of each situation, and promptly escalate issues to the right stakeholders. At the end of each shift, they clearly communicate outstanding items and tasks to the incoming team to ensure continuity of operations and effective SOC performance.

Responsibilities

Primary Responsibilities

• Protect and Defend:
  • Monitor Customer Environments
    • Leverage the customer's security technologies to triage security alerts and identify potential threats.
  • Escalate confirmed or suspected Threats
    • Compile an actionable report that describes a threat to the customer environment and escalate through the appropriate channels.
  • Document Investigations
    • Record security investigation efforts in a thorough manner that allows for easy peer review and collaboration through the appropriate case management tool.
• Incident Response:
  • Execute standard operating procedures (SOPs) for common alert types
  • Perform basic artifact analysis (IP addresses, domains, file hashes)
  • Conduct initial containment actions (isolating hosts, blocking IPs) per runbooks
  • Document all actions taken with timestamps and evidence preservation
• Communicate and Collaborate:
  • Acknowledge and handle Customer Requests
    • Process communications from assigned customers and fulfill (or forward) the tasks as appropriate.
  • Support your Shift
    • Be available to your teammates while on shift and ready to assist them at all times.
  • Improve SOC Situational Awareness
    • Use the Shift Turnover Report to note outstanding work items, tasks and situations that the following shifts should be aware of.

Secondary Responsibilities

• Maintain SOC Readiness:
  • Verify and Improve Customer Access
    • Take responsibility of your overall access situation and work with the Program Managers to achieve 100% access across all customers.
  • Identify and Fill knowledge gaps
    • Convert localized tribal knowledge into global shared knowledge through SharePoint articles and documents for the entire SOC to benefit from.
  • Update outdated documentation
    • Take stock of currently existing documentation and change the information as necessary to keep the knowledge base current.
• Continuous Development:
  • Keep up-to-date on Threat Landscape
    • Review Threat Intelligence's weekly Cyber Threat Reports and crawl the open web to learn about contemporary threats to our environments.
  • Hone Blue Team skills
    • Seek out challenges and trainings to improve your Analysis skillset.
  • Get Creative
    • Take a proactive approach to problems encountered in your career and consider possible solutions you or the team can implement to overcome them.

Qualifications

• 1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC/NOC or similar environment.
• Hands-on experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage.
• Experience using endpoint detection and response (EDR) tools for basic investigation and containment.
• Practical experience triaging alerts, performing basic artifact analysis, and escalating incidents.
• Exposure to incident response activities (initial containment, documentation, coordination with senior analysts).
• Experience working in a 24x7 or shift-based operational environment.
• Experience documenting investigations and maintaining accurate tickets/case records.
• Solid understanding of network protocols and architecture (TCP/IP, DNS, HTTP/S, VPNs, common ports/services).
• Proficiency in basic log analysis and event correlation across multiple data sources (endpoint, network, identity, cloud).
• Familiarity with major threat frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain) and their practical application.
• Working knowledge of Windows and Linux operating systems from a security and operations perspective.
• Familiarity with at least one major cloud environment (Azure, AWS, or GCP) and its core security concepts.
• Ability to execute SOPs and runbooks for common alert types and initial containment (host isolation, blocking IPs/domains).
• Ability to perform basic artifact analysis (IP addresses, domains, URLs, file hashes, simple email header review).
• Comfortable using case management and collaboration tools to track and share investigation details.
• Proactive and self-motivated approach to monitoring, investigation, and continuous improvement.
• Strong analytical and problem-solving skills applied to alert triage and incident assessment.
• High attention to detail and accuracy in documentation, evidence handling, and severity assessment.
• Excellent written communication skills for clear, concise tickets, incident notes, and handover reports.
• Effective verbal communication skills for collaboration with teammates and cross-functional partners.
• Ability to work under pressure during active security incidents while maintaining composure and quality.
• Team-oriented mindset with strong collaboration and knowledge-sharing habits.
• Continuous learning attitude, staying current with evolving threats, tools, and best practices.
• At least one entry-level cybersecurity certification (e.g., CompTIA Security+, ISC2 CC, or equivalent).

Requirements

• 2–4+ years of direct SOC, incident response, or security monitoring experience.
• Advanced experience with Microsoft Sentinel and/or Microsoft security stack (Defender, M365, Entra ID).
• Hands-on experience supporting or leading incident response for medium to high-severity events.
• Exposure to cloud security monitoring and hardening (Azure, AWS, or GCP).
• Experience tuning SIEM/EDR alerts and creating or refining detection use cases.
• Familiarity with scripting or automation (Python, PowerShell, KQL, Bash) to support investigations.
• Experience working in client-facing or consulting environments.
• Prior involvement in SOC process improvements, documentation, or automation initiatives.
• One or more intermediate certifications (e.g., CySA+, GSEC, GCIH, CISSP Associate, or equivalent).

Benefits

• The salary associated with this position ($64,000-$128,000) is commensurate with the selected candidate’s qualifications, years of relevant experience, and demonstrated level of expertise.
• Nightwing offers medical, vision and dental insurance coverage in addition to a 401k plan, PTO, Holidays, and additional insurances.

Company Description

Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers’ most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.