Position Summary

ECS is seeking a Data Security Analyst - Journeyman to support the Army National Guard (ARNG) Enterprise Network Operations and Cybersecurity Support (ENOCS) program. This position supports Task 3 - Cybersecurity Operations Support - by engineering data integration solutions that enable reliable ingestion, parsing, and transformation of cybersecurity telemetry across SOC, CDAP, and analytic platforms. The role works closely with analytic developers, security engineers, and cybersecurity operations personnel to improve data quality, resolve ingestion discrepancies, and sustain continuous monitoring visibility that supports Defensive Cyberspace Operations - Internal Defensive Measures (DCO-IDM) across the DoDIN-Army-NG area of responsibility.

Please Note: This position is contingent upon contract award.

This role contributes to protection of ARNG classified and unclassified network environments supporting more than 120,000 users and approximately 141,000 endpoints across about 2,800 sites in 54 states and territories. The Data Security Analyst - Journeyman helps enable centralized visibility and machine-speed response through integrated SIEM/C2C/DLP analytics, supports coordination with USIEM engineers on enabling data sources, and helps maintain actionable cyber data flows for operations conducted in coordination with the NETCOM Global Cyber Center and DISA DCDC. The position directly supports ARNG Title 10 and Title 32 missions, including mobilization readiness, domestic emergency response, and cybersecurity operations spanning both NIPRNet and SIPRNet environments.

Responsibilities

• Engineer data integration solutions that support reliable ingestion, normalization, parsing, and transformation of cybersecurity telemetry across SOC, CDAP, and analytic platforms.
• Implement schema management and data validation routines to improve data accuracy, traceability, and consistency for cybersecurity monitoring and reporting.
• Optimize data pipelines and processing performance to support scalable visibility across ARNG's distributed enterprise of approximately 141,000 endpoints and 2,800 sites.
• Collaborate with analytic developers and security engineers to resolve ingestion discrepancies, improve telemetry quality, and strengthen threat-informed detections.
• Support integrated SIEM/C2C/DLP analytics by preparing and refining data feeds that enable centralized visibility and faster cyber defense actions.
• Coordinate with USIEM engineers to identify, onboard, and improve enabling data sources used for monitoring, correlation, and MITRE ATT&CK-based analytics.
• Maintain data quality and continuous monitoring visibility that supports 24x7x365 cybersecurity operations across ARNG classified and unclassified network environments.
• Assist in producing reliable data outputs that support monitoring, incident analysis, reporting, and governance activities aligned with ARNG and DoD cybersecurity policy.
• Contribute to data handling and telemetry support for cybersecurity operations conducted in coordination with the NETCOM Global Cyber Center and DISA DCDC.

Required Qualifications

U.S. Citizenship is required

Security Clearance: Secret Eligible

Required Certifications: DCWF Work Role 511-Cyber Defense Analyst - Basic proficiency; must hold ONE OR MORE of the following: CC, CEH, GFACT, GISF

Experience: 3+ years of experience in cybersecurity

• Experience engineering or supporting data ingestion, parsing, and transformation workflows for cybersecurity telemetry.
• Experience implementing data validation, schema management, or related controls to improve data quality for security operations use.
• Experience supporting continuous monitoring, analytic visibility, or reporting within a cybersecurity operations environment.
• Experience collaborating with security engineers, analysts, or analytic developers to troubleshoot data discrepancies and improve operational outputs.
• Ability to support telemetry integration and reporting needs across multiple cybersecurity platforms or operational teams.
• Experience documenting data issues, validation results, and corrective actions in support of operational monitoring and governance.