Bachelor's degree in a technical discipline from an accredited university
5 years of relevant cybersecurity experience in security operations or incident response
2 years of experience in root cause analysis of cybersecurity events
Experience with at least two cybersecurity tools (e.g., firewalls, IDS/IPS)
Working knowledge of Defense-in-Depth principles
Experience in developing scripts or automation for threat detection using SPL, Python, or PowerShell
Active DoD Top Secret security clearance required
Responsibilities
Monitor SIEM platforms and cybersecurity tools 24/7 to detect and respond to threats
Protect and analyze unauthorized or malicious activity across the network
Employ response actions for specific security alerts and incidents
Analyze logged security events to identify trends and potential attacks
Monitor network logs for indicators of Advanced Persistent Threats (APTs)
Stay updated on current cyber threats using intelligence resources
Provide technical analysis and support for cybersecurity tools
Implement and maintain Defense-in-Depth strategies to mitigate network threats
Benefits
On-site work locations in Columbus, OH; Battlecreek, MI; or Ft. Belvoir, VA
Opportunity to support a Defense Logistics Agency program
Engagement in a critical cybersecurity role with potential for career growth
Involvement in a 24/7 operational environment
Access to advanced cybersecurity tools and technologies
Full Job Description
OCH Technologies is actively looking for a Cybersecurity Incident Response & Threat Detection Analyst supporting a Defense Logistics Agency program.
This position supports a proposal effort and is contingent upon award, customer approval, and successful onboarding requirements.
Location
On-site: Columbus, OH OR Battlecreek, MI OR Ft. Belvoir, VA
Core Responsibilities & Duties
Participates in 24x7x365 monitoring of Security Information and Event Management (SIEM) platforms and other cybersecurity monitoring tools to detect, investigate, and respond to cybersecurity threats within the enterprise network environment.
Performs cybersecurity actions to protect, monitor, detect, analyze, and respond to unauthorized or potentially malicious activity across the enterprise environment.
Employs cybersecurity capabilities and deliberate response actions to address specific security alerts, incidents, and emerging threats.
Reviews and analyzes logged security events to identify trends, patterns, and indicators of potential attack, compromise, or malicious activity within the environment.
Actively monitors network logs and traffic to identify indicators of Advanced Persistent Threats (APTs), "low and slow" attacks, and other sophisticated attack techniques.
Maintains awareness of current and emerging cyber threats through the use of intelligence resources, including Open Source Intelligence (OSINT).
Performs technical analysis, troubleshooting, and sustainment support for enterprise cybersecurity tools, technologies, and applications.
Supports the implementation and maintenance of Defense-in-Depth strategies, including cybersecurity signatures, detection capabilities, and perimeter defense controls designed to mitigate and reduce network threats.
Responsibilities may evolve over time to support team and organizational goals, but will remain consistent with the overall scope of the role.
Requirements
Minimum Qualifications
Education
Bachelor's degree (BS or BA) in a technical discipline from an accredited university
Experience
Five (5) years of relevant cybersecurity experience supporting security operations, threat detection, incident response, or related cybersecurity functions.
Two (2) years of experience conducting root cause analysis of cybersecurity events and incidents, including identifying contributing factors, attack vectors, and remediation opportunities.
Demonstrated experience using at least two types of cybersecurity tools or technologies, such as firewalls, intrusion detection/prevention systems (IDS/IPS), host-based antivirus/endpoint protection, data loss prevention (DLP), vulnerability management, digital forensics, malware analysis, or device hardening solutions.
Working knowledge of Defense-in-Depth principles and their application to cybersecurity architecture, threat prevention, detection, and response.
Experience developing scripts, tools, or automation to enhance threat detection and incident response capabilities, preferably using SPL, Python, and/or PowerShell.
Security Clearance Requirement
Must possess an active IT-I (Critical-Sensitive) security designation or Tier 5 (T5) investigation at the time of proposal submission.
Must possess an active DoD Top Secret security clearance, be eligible for IT-I designation, and be eligible for access to Sensitive Compartmented Information (SCI).
