Cyber Security Operations Specialist II/Tier 2

The Opportunity:

CACI helps power and secure the enterprise networks of the National Geospatial-Intelligence Agency (NGA) on its Transport & Cybersecurity Services (TCS) program. The functional capabilities are to coordinate the cybersecurity and information technology (IT) infrastructure services required to deliver timely, relevant, and accurate GEOINT in support of a wide range of missions for the U.S. Department of War (DoW) and the Intelligence Community (IC). TCS provides innovative design, engineering, procurement, implementation, operations, sustainment and disposal of transport and cybersecurity IT resources on multiple networks and security domains, across various locations worldwide.

As a Tier 2 (mid- to upper-skill level) Cyber Defense Analyst, you will serve as the critical analytical bridge between initial triage and advanced incident response for NGA networks. In this role, you will perform deep-dive correlation and analysis of cyber events, leveraging advanced security tools to gather evidence and execute response actions that ensure the agency’s cybersecurity posture remains resilient against adversary activity.
You will operate within a dynamic 24x7x365 Cyber Security Operations Center (CSOC), collaborating closely with junior analysts to provide mentorship, and teaming up with senior incident responders to escalate and neutralize complex threats. Beyond steady-state operations, you will actively participate in tabletop exercises, simulations, and major Cyber Incident Response operations to continuously refine and elevate the agency’s defensive cyber capabilities.

Responsibilities:

•             Conduct Comprehensive Investigations: Lead investigations into escalated cyber events, building robust case files that accurately characterize the true nature, scope, and potential threat of the activity.
•             Leverage Advanced Analytics: Utilize advanced search queries within SIEM platforms (such as Splunk, Elastic, and Microsoft Sentinel) to parse, analyze, and correlate complex log data.
•             Apply Threat Intelligence: Actively track Malicious Cyber Actor (MCA) intrusion sets based on current threat intelligence and identify correlated Indicators of Compromise (IoCs) within the enterprise environment.
•             Execute & Document Response: Perform appropriate response actions and document your findings in the IT service management system with meticulous detail, ensuring your analysis can be seamlessly reconstructed by peer analysts or leadership.
•             Identify Insider Threats: Proactively identify network activity indicative of potential insider threats and escalate these instances to the agency’s counterintelligence element.
•             Classify Cyber Incidents: Evaluate events and provide expert recommendations on incident categorization in strict accordance with CJCSM 6510.01B criteria.
•             Support Enterprise Architecture: Develop and apply a deep understanding of enterprise network architecture and the strategic placement of security devices to contextualize anomalous traffic and strengthen overall network defense.
•             Perform Crisis Operations: Serve as a core member of the Cyber Incident Response Team (C-IRT) during major declared incidents, operating in conjunction with other cyber organizations.
•             Ensure Mission Continuity: Maintain readiness to relocate to a designated Continuity of Operations (COOP) site during exercises or real-world crises to sustain uninterrupted CSOC operations.

Qualifications:

Required: 

•             Must be a US citizen with an active TS/SCI to start work; will be required to obtain a CI Poly within 6 months of hire;
•             Typically have a university degree (BA/BS) or equivalent experience and minimum 4 years of related work experience;
•             Hold current certifications that are compliant with DoD 8140.03 and DoD 8570.01-M IAT Level II and CSSP Analyst baseline certification lists;
•             Ability to work 1 of 5 shifts during the week, either 8 hours (weekdays) or 12 hours (weekends).

Desired:

•             DoD 8570 IAT Level III certification;
•             Active TS/SCI based on a counterintelligence (CI) poly;
•             5+ years of related CSOC tier 2 or 3 work experience.

Pay Range:

There are a host of factors that can influence final salary including, but not limited to, geographic location, Federal Government contract labor categories and contract wage rates, relevant prior work experience, specific skills and competencies, education, and certifications. Our employees value the flexibility at CACI that allows them to balance quality work and their personal lives. We offer competitive compensation, benefits and learning and development opportunities. Our broad and competitive mix of benefits options is designed to support and protect employees and their families. At CACI, you will receive comprehensive benefits such as; healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits.

The proposed salary range for this position is: