Cyber Defense Analyst – Tier 1

🔥 0 minutes ago

⚔️ Virginia – Remote

⚔️ Virginia – Remote

💵 $64k - $128k / year

⏰ Full Time

🟢 Junior

🧐 Analyst

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Just posted.
• Jobs at this company usually fill in 28 days.

Apply Now

Find Similar Remote Jobs

Nightwing

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

💼 Consulting

🎖️ Defense

🔒 Cybersecurity

Consulting • Defense • Cybersecurity

Nightwing is an intelligence services company that continually redefines the edge of possible to advance national security interests. Serving both government agencies and commercial organizations, Nightwing specializes in cybersecurity and intelligence solutions, offering capabilities in offensive and defensive cyber operations, data operations, software modernization, and technical surveillance. Their mission is to stay ahead of evolving threats through innovative solutions and unwavering reliability, ensuring that their clients remain protected in high-stakes environments.

📋 Description

• Monitor customer environments using security technologies to triage alerts and identify potential threats • Compile actionable threat reports and escalate confirmed or suspected threats through appropriate channels • Document security investigations thoroughly in case management tools • Execute standard operating procedures for common alert types • Perform basic artifact analysis involving IP addresses, domains, file hashes, URLs, and email headers • Conduct initial containment actions such as isolating hosts and blocking IPs or domains • Document actions with timestamps and preserve evidence • Process customer communications and fulfill or forward requests • Support teammates during assigned shifts • Maintain shift turnover reports covering outstanding work items and situations • Verify and improve customer access, working with Program Managers toward full access • Convert tribal knowledge into SharePoint articles and shared documentation • Update outdated documentation and maintain the knowledge base • Review weekly Cyber Threat Reports and open-web information to stay current on threats • Attend or review weekly Threat Intelligence briefings • Provide feedback on threat intelligence reports • Document and follow up on Program Management requests • Communicate with Customer Tech Leads and identify alert-tuning opportunities • Communicate with Engineering teams regarding system availability and performance issues

🎯 Requirements

• 1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC/NOC or similar environment • Hands-on experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage • Experience using endpoint detection and response (EDR) tools for basic investigation and containment • Practical experience triaging alerts, performing basic artifact analysis, and escalating incidents • Exposure to incident response activities, including initial containment, documentation, and coordination with senior analysts • Experience working in a 24x7 or shift-based operational environment • Experience documenting investigations and maintaining accurate tickets/case records • Solid understanding of network protocols and architecture, including TCP/IP, DNS, HTTP/S, VPNs, and common ports/services • Proficiency in basic log analysis and event correlation across endpoint, network, identity, and cloud data sources • Familiarity with MITRE ATT&CK, Cyber Kill Chain, or major threat frameworks • Working knowledge of Windows and Linux operating systems from a security and operations perspective • Familiarity with at least one major cloud environment: Azure, AWS, or GCP • Ability to execute SOPs and runbooks for common alert types and initial containment • Ability to perform basic artifact analysis, including IP addresses, domains, URLs, file hashes, and simple email header review • Comfort using case management and collaboration tools • At least one entry-level cybersecurity certification, such as CompTIA Security+, ISC2 CC, or equivalent • Preferred: 2–4+ years of direct SOC, incident response, or security monitoring experience • Preferred: Advanced experience with Microsoft Sentinel and/or Microsoft security stack • Preferred: Hands-on experience supporting or leading medium- to high-severity incident response • Preferred: Exposure to cloud security monitoring and hardening • Preferred: Experience tuning SIEM/EDR alerts and creating or refining detection use cases • Preferred: Familiarity with Python, PowerShell, KQL, or Bash • Preferred: Experience in client-facing or consulting environments • Preferred: SOC process improvement, documentation, or automation experience • Preferred: Intermediate certifications such as CySA+, GSEC, GCIH, CISSP Associate, or equivalent

🏖️ Benefits

• Medical insurance coverage • Vision insurance coverage • Dental insurance coverage • 401k plan • PTO • Holidays • Additional insurances

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume