Cyber Defense Analyst (Tier 1) - Afternoon

Location: Remote, VA, United States

Salary: $64,000–$128,000 per year

Company

hirify.global provides cyber defense, data operations, systems integration, intelligence mission support, software modernization, and related services for intelligence, defense, civil, and commercial customers.

What you will do

• Monitor customer environments, triage security alerts, distinguish meaningful threats from background noise, and assess severity.
• Escalate confirmed or suspected threats through appropriate channels and prepare actionable customer reports.
• Execute SOPs and runbooks, perform basic artifact analysis, and conduct initial containment such as host isolation and IP blocking.
• Document investigations, actions, timestamps, evidence, tickets, and case records.
• Process customer requests, collaborate with analysts and cross-functional teams, and provide shift handover information.
• Maintain customer access, improve documentation and shared knowledge, review threat intelligence, and identify alert-tuning opportunities.

Requirements

• 1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC, NOC, or similar environment; experience in a 24x7 or shift-based operational environment is required.
• Hands-on experience with at least one SIEM/XDR platform, such as Microsoft Sentinel, for alert monitoring and triage.
• Experience using EDR tools, triaging alerts, performing basic artifact analysis, escalating incidents, and participating in initial incident response and containment.
• Experience documenting investigations and maintaining accurate tickets or case records.
• Solid understanding of TCP/IP, DNS, HTTP/S, VPNs, common ports and services, log analysis, and event correlation across endpoint, network, identity, and cloud data sources.
• Familiarity with MITRE ATT&CK or Cyber Kill Chain, Windows and Linux security operations, and at least one cloud environment: Azure, AWS, or GCP.
• Ability to execute SOPs and runbooks, analyze IP addresses, domains, URLs, file hashes, and simple email headers, and use case management and collaboration tools.
• Proactive, analytical, detail-oriented, self-motivated, and able to communicate clearly in tickets, incident notes, handover reports, and cross-functional collaboration.
• At least one entry-level cybersecurity certification, such as CompTIA Security+, ISC2 CC, or equivalent.

Nice to have

• 2–4+ years of direct SOC, incident response, or security monitoring experience.
• Advanced Microsoft Sentinel or Microsoft security stack experience, including Defender, M365, or Entra ID.
• Experience supporting or leading medium- to high-severity incident response, cloud security monitoring and hardening, or SIEM/EDR alert tuning.
• Scripting or automation experience with Python, PowerShell, KQL, or Bash.
• Client-facing or consulting experience and involvement in SOC process improvement, documentation, or automation.
• Intermediate certification such as CySA+, GSEC, GCIH, CISSP Associate, or equivalent.

Culture & Benefits

• Remote, full-time work supporting afternoon shift SOC operations.
• Medical, vision, and dental insurance coverage.
• 401(k) plan, paid time off, holidays, and additional insurance coverage.
• Continuous learning through threat intelligence briefings, training, and blue-team skill development.