Senior SOC Cyber Analyst (Forensics)

Akira Technologies is seeking a Senior SOC Analyst team member is responsible for the analysis of all technology devices which may include Operational Technology (OT) and Industrial Control Systems (ICS) within enterprise. This includes analytical analysis of device communication, forensic analysis of Windows or Linux systems and servers, timeline analysis of activity on these endpoints, user permission and authentication audits, log analysis, and malware identification/triage.

This role is an onsite position supporting a government client in Port Hueneme, CA five days a week.  This also requires candidates with an active Top Secret security clearance or higher.

An ideal candidate for this position will be a proactive self-starter who has experience with system administration, Windows and Linux operating systems (OS) mechanics and filesystem structures, disk and memory forensics, commonly abused tools/vectors for persistence, privilege escalation, and lateral movement, operating system log analysis, and triaging suspicious file artifacts for unusual behavior, with respect to the environment they are found in. This role requires a familiarity with what routine OS activities and common software/user behavior looks like in the context of forensic artifacts or timelines. Analysts should also be familiar with common categories and formats of host-based indicators of compromise (IOCs) and how/where they can be leveraged to identify known-bad files/activity on an endpoint. Candidate will utilize the Cyber Kill Chain and define the entire attack life cycle along with creating detailed reports on how impacts may or have occurred.

As a senior role candidate will assist in reviews and provide feedback to journeyman and junior analysts’ investigation and facilitate discussions on recommendations on improving SOC visibility, efficiency, and/or processes. Secondary role will also focus on identifying unusual files, scripts, configurations, and user activity based on bulk aggregation via an Endpoint Detection and Response (EDR) or triage tools, and coordinate forensics centric efforts with case management oversight. 

Job Responsibilities

• Support client leaders in establishing and managing a Security Operations Center (SOC) to provide a secure environment that facilitates incident response and threat hunting activities.
• Provide oversight over more junior cyber analysts and assist client with prioritization and milestone tracking for efforts related to the SOC
• Manage the security information and event management (SIEM) platform to monitor for security alerts and coordinate vulnerability assessments and artifact collection across servers and network devices
• Evaluate network structures and device configurations for security risks, offering recommendations based on best practices, and gather data to identify and respond to network intrusions
• Analyze network traffic and system logs to identify malicious activities, vulnerabilities exploited, and methods used, and develop processes to enhance SOC response and efficiency
• Conduct comprehensive technical analyses of computer evidence, research and integrate new security tools into the SOC, and synthesize findings into reports for both technical and non-technical audiences
• Perform forensic analysis of Windows and Linux clients and servers, other control operating systems, timeline analysis of activity on these endpoints, user permission and authentication audits, log analysis, and malware identification/triage. 

Job Qualifications

• (Senior level) At least 5 years of experience in security operations, demonstrating leadership in customer-facing roles
• Deep understanding in host/network forensics software tool kits (e.g. MAGNET, EnCase, Sleuthkit, FTK)
• Understands evidence handling processes and procedures specifically in DoD environments
• Able to ensure completed collection of artifacts to provided best possible outcome of a case
• Proficient in analyzing cyber-attacks, with a deep understanding of attack classifications, stages, system/application vulnerabilities, and compliance with Department of Defense (DoD) policies and procedures
• Extensive knowledge of network topologies, protocols (e.g., TCP/IP, ICMP, HTTP/S, DNS, SSH, SMTP, SMB), and experience with tools like Palo Alto, Elastic SIEM, Cribl, Splunk, VMware, Security Center 
• Capable of attack reconstruction based on network traffic, integrating Threat Intelligence, and familiar with MITRE ATT&CK framework, with the ability to collaborate effectively across multiple locations.

Preferred Skill Sets

• Knowledge of Operational Technology (OT) or Industrial Control Systems (ICS)
• Strong analytical and troubleshooting skills
• Proficient in forensics software tool kit (MAGNET)
• Able to provide expert content development in Splunk Enterprise Security using tstats and data models
• Understands how to utilize knowledge of latest threats and attack vectors to develop correlation rules for continuous monitoring on various security appliances
• Experience in other tools and communication languages as applicable such as Nessus, Endgame, CrowdStrike, Gray Noise, Shodan, Bacnet, MODBus, SCADA systems, and PCAP
• Review logs to determine if relevant data is present to accelerate against data models to work with existing use cases
• Certified Ethical Hacker (CEH), GIAC Certified Incident Handler (GCIH), or relevant IT technology certification

Salary Range:  $150,000 to $170,000

Akira’s pay range for this position considers various factors including skills, years of experience, training, licenses, certifications, alignment with market data, and internal equity in the organization.  This pay range estimate is a general guideline only and not a guarantee of compensation or salary, which Akira believes to be done in good faith in compliance with local laws.  The disclosed range estimate has not been adjusted for the applicable geographic differential associated with the location at which the position may be filled. It is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case.

General Description of Benefits

Akira offers its employees multiple options for medical plans (some with Health Savings Account), dental plans, and vision coverage, and a 401(k) plan with employer match.  To promote work/life balance, Akira offers paid time off, including vacation and sick time, holidays, paid parental leave, military leave, bereavement leave, and jury duty leave.  We also offer short and long-term disability benefits to protect employee income in the event of sickness or injury, life insurance, accidental death and dismemberment insurance, and critical illness insurance.  Akira also offers tuition, training, and certification reimbursement for professional development and career advancement.

Akira regularly reviews our total rewards package to ensure our offerings remain competitive and reflect the values and needs expressed by our employees.

About Akira Technologies

Akira strives to meet and exceed the mission and objectives of US federal agencies. As a leading small business cloud modernization and data analytics services provider, we deliver trusted and highly differentiated solutions and technologies that serve the needs of our customers and citizens. Akira serves as a valued partner to essential government agencies across the intelligence, cyber, defense, civilian, and health markets. Every day, our employees deliver transformational outcomes, solving the most daunting challenges facing our customers.

Akira is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

Salary : $150,000 - $170,000