Cyber Security Engineer

Defensive Cyber Operations (DCO) Watch Analyst – Tier II

Location: North Charleston, SC

Clearance: Active Secret required to start, TS/SCI required

This Tier 2 Defensive Cyber Operations (DCO) Watch Analyst role is responsible for analyzing and responding to security incidents within a Cybersecurity Service Provider (CSSP) environment. The position involves investigating validated events, coordinating with stakeholders, and performing in-depth analysis to identify, mitigate, and document cyber incidents.

• Analyze and respond to validated security incidents, determining severity and impact in accordance with CJCSM 6510.01B
• Support incident response campaigns by organizing response efforts, tracking progress, and ensuring complete documentation
• Coordinate with reporting agencies and subscriber sites to ensure timely and accurate incident reporting
• Perform network and host-based digital forensics on Windows and other operating systems as needed
• Conduct log correlation analysis using Splunk and other tools to identify abnormal patterns in network and system activity
• Develop and maintain internal SOP documentation, ensuring compliance with CJCSM 6510.01B and other applicable directives
• Provide 24/7 support for incident response during assigned shifts, including nights, weekends, and holidays as needed
• Assist with IDS/IPS signature development and implementation under guidance
• Work within a 24/7/365 operational environment across regional operation centers (ROCs)
• Shifts are four 10-hour days (Sunday–Wednesday or Wednesday–Saturday), assigned at management’s discretion
• Up to 10% travel may be required

• Bachelor’s degree in a related discipline and at least 2 years of experience,
  or 5+ years of experience working in a CSSP, SOC, or similar environment
• Must be a U.S. citizen

• Experience with log aggregation tools (Splunk, Elastic, Sentinel)
• Familiarity with IDS/IPS systems, host-based, and OS logging solutions
• Experience performing digital forensics on Windows and/or Linux environments
• Demonstrated experience in threat hunting or incident response
• Working knowledge of CJCSM 6510.01B
• Strong analytical and problem-solving skills
• Excellent verbal and written communication

• Must meet DoD 8570 IAT Level II and CSSP-specific certification requirements