Cyber Defense Analyst, Tier 1 – Overnight

Job not on LinkedIn

🔥 11 minutes ago

⚔️ Virginia – Remote

⚔️ Virginia – Remote

💵 $64k - $128k / year

⏰ Full Time

🟢 Junior

🧐 Analyst

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Just posted.
• Jobs at this company usually fill in 28 days.

Apply Now

Find Similar Remote Jobs

Nightwing

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

💼 Consulting

🎖️ Defense

🔒 Cybersecurity

Consulting • Defense • Cybersecurity

Nightwing is an intelligence services company that continually redefines the edge of possible to advance national security interests. Serving both government agencies and commercial organizations, Nightwing specializes in cybersecurity and intelligence solutions, offering capabilities in offensive and defensive cyber operations, data operations, software modernization, and technical surveillance. Their mission is to stay ahead of evolving threats through innovative solutions and unwavering reliability, ensuring that their clients remain protected in high-stakes environments.

📋 Description

• Monitor customer environments and triage security alerts to identify potential threats • Escalate confirmed or suspected threats through appropriate channels with actionable reports • Thoroughly document security investigations in the case management tool • Execute standard operating procedures for common alert types • Perform basic artifact analysis, including IP addresses, domains, file hashes, URLs, and simple email headers • Conduct initial containment actions such as isolating hosts and blocking IPs/domains per runbooks • Document all actions with timestamps and preserve evidence • Process customer requests and fulfill or forward tasks as appropriate • Support teammates during shifts • Use Shift Turnover Reports to communicate outstanding work items and situations to following shifts • Verify and improve customer access and work with Program Managers to achieve 100% access across customers • Convert localized knowledge into shared SOC knowledge through SharePoint articles and documents • Update outdated documentation and maintain the knowledge base • Review weekly Cyber Threat Reports and monitor the open web for contemporary threats • Pursue training and challenges to improve blue-team analysis skills • Attend or review weekly Threat Intelligence briefings and provide feedback on intelligence reports • Document and follow up on Program Management requests in the case management system • Communicate with Customer Technology Leads about environmental concerns and alert-tuning opportunities • Communicate with Engineering about issues affecting system availability or performance

🎯 Requirements

• 1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC/NOC or similar environment • Hands-on experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage • Experience using endpoint detection and response (EDR) tools for basic investigation and containment • Practical experience triaging alerts, performing basic artifact analysis, and escalating incidents • Exposure to incident response activities (initial containment, documentation, coordination with senior analysts) • Experience working in a 24x7 or shift-based operational environment • Experience documenting investigations and maintaining accurate tickets/case records • Solid understanding of network protocols and architecture (TCP/IP, DNS, HTTP/S, VPNs, common ports/services) • Proficiency in basic log analysis and event correlation across multiple data sources (endpoint, network, identity, cloud) • Familiarity with major threat frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain) and their practical application • Working knowledge of Windows and Linux operating systems from a security and operations perspective • Familiarity with at least one major cloud environment (Azure, AWS, or GCP) and its core security concepts • Ability to execute SOPs and runbooks for common alert types and initial containment (host isolation, blocking IPs/domains) • Ability to perform basic artifact analysis (IP addresses, domains, URLs, file hashes, simple email header review) • Comfortable using case management and collaboration tools to track and share investigation details • At least one entry-level cybersecurity certification (e.g., CompTIA Security+, ISC2 CC, or equivalent) • Preferred: 2–4+ years of direct SOC, incident response, or security monitoring experience • Preferred: Advanced experience with Microsoft Sentinel and/or Microsoft security stack (Defender, M365, Entra ID) • Preferred: Hands-on experience supporting or leading incident response for medium to high-severity events • Preferred: Exposure to cloud security monitoring and hardening (Azure, AWS, or GCP) • Preferred: Experience tuning SIEM/EDR alerts and creating or refining detection use cases • Preferred: Familiarity with scripting or automation (Python, PowerShell, KQL, Bash) to support investigations • Preferred: Experience working in client-facing or consulting environments • Preferred: Prior involvement in SOC process improvements, documentation, or automation initiatives • Preferred: One or more intermediate certifications (e.g., CySA+, GSEC, GCIH, CISSP Associate, or equivalent)

🏖️ Benefits

• Medical insurance coverage • Vision insurance coverage • Dental insurance coverage • 401k plan • PTO • Holidays • Additional insurances

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume