SOC Analyst

As a SOC Analyst at Leidos, your primary responsibilities include coordinating the investigation and response efforts throughout the Incident Response lifecycle, analyzing cyber events and data to gauge the extent of incidents, and recognizing potential indicators of compromise. You'll also be tasked with developing and documenting Incident Response processes and tuning security tools to enhance SOC operations.

Candidates for the SOC Analyst position at Leidos should possess a bachelor’s degree in IT or a related field, complemented by 4-8 years of experience in cybersecurity or incident response. Relevant certifications in cybersecurity will also be considered in lieu of degree requirements, along with knowledge of operating systems and network architecture.

Leidos promotes a vibrant and engaging work environment for SOC Analysts, focusing on team empowerment, community contribution, and sustainable operations. You'll be joining a diverse team committed to delivering innovative solutions and achieving customer success, alongside a culture that values integrity and collaboration.

SOC Analysts at Leidos work with essential tools such as Security Information and Event Management (SIEM) systems, Endpoint Detection and Response (EDR) software, and Intrusion Detection Systems (IDS). You’ll also engage with various cybersecurity technologies, analyzing data from networks, servers, and security devices to understand and respond to threats effectively.

Yes, there are excellent opportunities for growth as a SOC Analyst at Leidos. The organization emphasizes continuous learning and professional development, encouraging you to pursue relevant certifications and enhancing your skills through various initiatives. As you contribute to the team’s success, there is room for advancement within the cybersecurity domain.

The Incident Response lifecycle includes several phases: preparation, detection and analysis, containment, eradication, and recovery, followed by post-incident activities. Each phase requires meticulous planning, timely response, and thorough documentation to effectively manage and mitigate cybersecurity incidents.

Prioritizing multiple security incidents involves assessing each event based on its severity, impact, and urgency. I leverage existing frameworks to classify the incidents and utilize automation tools to streamline the response process, ensuring critical threats are addressed promptly while maintaining communication with relevant stakeholders.

In a SOC environment, I utilize various analysis techniques including log analysis, threat intelligence feeds, and anomaly detection. I correlate data from different sources such as SIEM systems and network logs to visualize patterns that indicate potential threats or breaches.

Upon detecting an incident, I would first contain the threat to prevent further damage, followed by thorough analysis to understand the scope and impact. Active communication is vital as I collaborate with the incident response team to eradicate the threat and initiate recovery processes, documenting each action for future reference.

I possess several relevant certifications, including GCIH and CEH, which demonstrate my knowledge of incident handling and ethical hacking practices. These certifications not only enhance my understanding of cyber threats but also validate my commitment to continuous learning in the cybersecurity field.

I have utilized the ATT&CK Framework to better understand adversary tactics, techniques, and procedures in my analysis work. This framework helps me identify patterns and potential indicators of compromise within threat data, allowing for more informed decisions and tailored incident response strategies.

Documenting incidents and response actions involves thorough record-keeping of each phase of the incident lifecycle. I ensure I note all details, including timestamps, actions taken, and the rationale behind decisions. This documentation serves both as a record for future reference and as a means to improve processes.

Certainly! I identified a sophisticated attack during a routine monitoring session. By recognizing unusual patterns in user behavior and network traffic, I was able to compute an estimated timeline and alert the team, which led to prompt containment of the threat before any significant damage occurred.

I regularly follow industry news, participate in webinars, and engage with professional communities online. Additionally, I subscribe to threat intelligence services and cybersecurity blogs which help me stay informed about emerging threats, vulnerabilities, and best practices in incident response.

Teamwork is crucial for a SOC Analyst's effectiveness. Collaborating with my colleagues enables us to leverage diverse perspectives, share insights, and coordinate responses more efficiently. This collaborative approach greatly enhances our overall security posture and enables more robust incident response.