Sr. Security Analyst

@ ECS Tech Inc

Job Overview

ECS Tech Inc is seeking a Sr. Security Analyst to work in our Fairfax, VA office. This role is contingent upon contract award.

About ECS Tech Inc

As a leading managed cybersecurity services provider, ECS delivers highly tailored solutions to each customer. The Professional Services Team works closely with clients to understand needs and deliver comprehensive solutions, including technical challenge resolution, data protection, and consulting on a broad range of security topics.

Responsibilities

• Network Monitoring and Intrusion Detection: Analyze network data using IDS/IPS, firewalls, and host-based security systems.
• SIEM Management: Utilize Elastic SIEM to correlate events and identify threat indicators.
• Threat Research: Investigate emerging threats and vulnerabilities to enhance incident detection.
• Threat Detection: Implement log-based and endpoint-based detection strategies.
• Content Development: Create and customize SIEM content including machine learning rules, signatures, and dashboards.
• Activity Correlation: Correlate data from network, cloud, and endpoints to spot attacks and unauthorized actions.
• Alert Management: Review, respond to alerts and document incidents in technical reports.
• Phishing Analysis: Analyze phishing email submissions to determine threat levels.
• Incident Response Support: Provide mitigation strategies to contain and recover from breaches.
• Threat Intelligence Integration: Collaborate with threat intelligence and hunting teams to stay updated on threat landscapes.
• Tool Evaluation: Assist in assessing new security tools and analytical techniques.
• Breach Investigation: Support both large-scale and smaller-scale cyber breach investigations.
• Stakeholder Communication: Clearly communicate cyber events and findings to internal and external stakeholders.

Qualifications

• 2+ years of cybersecurity experience
• Deep knowledge of Elastic SIEM (experience with Kibana, Logstash, Ingest Pipelines, Enterprise Search, or Observability preferred)
• Strong understanding of network protocols, encryption, and vulnerabilities
• Proficient analytical skills to detect anomalies in complex data
• Familiarity with scripting languages like Python or PowerShell
• Experience in creating and tuning SIEM rules, signatures, and dashboards
• Excellent written and verbal communication skills
• Ability to work under pressure in a fast-paced environment