Cyber Defense Analyst (Cybersecurity)

Location: Remote, VA, United States; overnight shift; remote workplace.

Salary: $64,000–$128,000 annually, based on qualifications, relevant experience, and expertise.

Company

hirify.global provides cyber defense, data operations, systems integration, intelligence mission support, software modernization, and related services for intelligence, defense, civil, and commercial customers.

What you will do

• Monitor customer environments and triage security alerts using SIEM, XDR, EDR, and other security technologies.
• Investigate alerts, analyze IP addresses, domains, URLs, file hashes, logs, and simple email headers, then assess severity and escalate threats.
• Execute SOPs and runbooks for common alerts and initial containment, including host isolation and blocking IPs or domains.
• Document investigations, evidence, timestamps, actions, tickets, and case records for peer review and collaboration.
• Handle customer requests and coordinate with analysts, intelligence, program management, customer technology leads, and engineering teams.
• Maintain shift turnover reports, identify alert-tuning opportunities, improve documentation, and support SOC readiness.

Requirements

• 1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC/NOC or similar environment, including experience in 24x7 or shift-based operations.
• Hands-on experience with at least one SIEM/XDR platform, such as Microsoft Sentinel, for alert monitoring and triage.
• Experience using EDR tools, triaging alerts, performing basic artifact analysis, escalating incidents, and participating in initial incident response and containment.
• Experience documenting investigations and maintaining accurate tickets or case records.
• Solid understanding of TCP/IP, DNS, HTTP/S, VPNs, and common ports and services; proficiency in log analysis and event correlation across endpoint, network, identity, and cloud sources.
• Familiarity with MITRE ATT&CK, Cyber Kill Chain, Windows, Linux, and at least one cloud environment: Azure, AWS, or GCP.
• Ability to execute SOPs and runbooks, perform basic artifact analysis, and use case management and collaboration tools.
• Proactive, analytical, detail-oriented, self-motivated, and able to communicate clearly in tickets, incident notes, and handover reports while working under pressure.
• At least one entry-level cybersecurity certification, such as CompTIA Security+, ISC2 CC, or equivalent.

Nice to have

• 2–4+ years of direct SOC, incident response, or security monitoring experience.
• Advanced experience with Microsoft Sentinel or the Microsoft security stack, including Defender, M365, or Entra ID.
• Experience supporting or leading medium- to high-severity incident response, cloud security monitoring and hardening, SIEM/EDR alert tuning, or detection use-case development.
• Familiarity with Python, PowerShell, KQL, or Bash for investigations and automation.
• Client-facing or consulting experience and participation in SOC process improvement, documentation, or automation initiatives.
• Intermediate certifications such as CySA+, GSEC, GCIH, CISSP Associate, or equivalent.

Culture & Benefits

• Remote, full-time overnight work supporting continuous SOC operations.
• Collaboration with analysts and cross-functional intelligence, program management, customer technology, and engineering teams.
• Medical, vision, and dental insurance; 401(k) plan; paid time off and holidays.
• Additional insurance coverage and an equal opportunity workplace.