NL-Security Operations Center; SOC Analyst Concord, CA

NL-25-023 Security Operations Center (SOC) Analyst job cord, CA. nLogic is hiring a Security Operations Center Analyst, also known as Local Defender, at Military Ocean Terminal Concord in Concord, California. The Local Defender is a critical cybersecurity role responsible for protecting the organization's digital assets through proactive monitoring, analysis, and response to cyber threats. This role combines the duties of a Security Operations Center (SOC) Analyst and Threat Analyst to ensure a holistic defense against emerging threats.

Work is performed on-site with occasional on-call duties for critical incidents in a collaborative, demanding environment requiring attention to emerging threats and vulnerabilities.

In this role, the candidate is expected to work with minimal guidance, in a cross‑functional team, ensuring reports and recommendations are effectively communicated and actioned to support the Government customer and mission requirements.

• SOC Activities and Duties
  • Monitor and analyze security events and alerts generated by SIEM platforms, firewalls, IDS/IPS, and endpoint detection tools to identify potential threats and anomalous behavior.
  • Analyze potential security incidents and investigate to determine the scope, impact, and root cause, and recommend effective remediation strategies.
  • Perform triage on security incidents to identify root causes and recommend appropriate mitigation measures.
  • Conduct regular reviews of SIEM reports to identify patterns, trends, and potential vulnerabilities within the organization's infrastructure.
  • Develop actionable recommendations based on SIEM data analysis to enhance detection capabilities, optimize alert configurations, and address identified gaps.
  • Escalate critical incidents to senior leadership or appropriate teams and provide detailed incident summaries with proposed mitigation actions.
  • Maintain accurate documentation of security events and incident‑handling procedures.
• Threat Analysis and Intelligence
  • Monitor and evaluate Cyber Tasking Orders (CTOs) and other directives from NETCOM, ensuring compliance and timely implementation of mitigations.
  • Conduct research on the latest organization’s environment threat vectors, attack methodologies, and adversarial tactics, techniques, and procedures (TTPs).
  • Collaborate with other cybersecurity team members and the government customer to integrate threat intelligence into incident detection and response processes.
  • Analyze CVEs, security bulletins, threat intelligence feeds, and security advisories to assess their relevance and potential impact to the mission and the organization’s environment.
  • Correlate threat intelligence with SIEM findings to identify and assess emerging threats.
  • Develop and communicate proactive mitigation strategies based on threat landscape trends and adversary tactics.
• Reporting and Communication
  • Generate detailed and actionable reports for leadership from SIEM platforms summarizing identified threats, incidents, and remediation steps.
  • Provide recommendations for improving the organization’s cybersecurity posture based on incident trends and threat intelligence.
  • Maintain clear communication with cross‑functional teams to ensure alignment with security objectives and protocols.
  • Generate detailed reports on threats, false positives, and actionable insights.
  • Provide the Government customer and leadership with concise, data‑driven recommendations for enhancing the organization’s cybersecurity defenses based on SIEM trends and incident analysis.
  • Prepare summaries and status updates of security posture improvements resulting from SIEM data analysis and implemented recommendations.
• Security Tool Management and Optimization
  • Support the configuration, tuning, and optimization of security monitoring tools, including SIEM and threat detection platforms.
  • Conduct periodic reviews and updates of security tools to address gaps or inefficiencies.
  • Participate in the testing and implementation of new security technologies as required.
  • Collaborate with the team and the stakeholder community to fine‑tune SIEM configurations, including custom rule creation and log source integration, to improve threat…