Company Overview:
By Light Professional IT Services LLC readies warfighters and federal agencies with technology and systems engineered to connect, protect, and prepare individuals and teams for whatever comes next. Headquartered in McLean, VA, By Light supports defense, civilian, and commercial IT customers worldwide.
Position Overview:
The Junior Cybersecurity Analyst supports 24x7 cybersecurity monitoring, incident detection, alert triage, ticket response, escalation management, and operational reporting activities within a Network Operations Center (NOC) and Cybersecurity Operations Center (CSOC) environment. The analyst assists in monitoring enterprise, cloud, and tactical network environments, identifying potential security events, responding to operational tickets, supporting incident response activities, and maintaining operational awareness across connected and disconnected operational environments.
This role supports continuous monitoring operations utilizing SIEM, IDS/IPS, EDR/XDR, vulnerability management, cloud security, Zero Trust access, and ticketing platforms while operating within established operational procedures, escalation workflows, SLA requirements, and security playbooks.
Responsibilities:
- Monitor security events, alerts, dashboards, and operational queues within SIEM, IDS/IPS, and cloud security platforms
- Respond to operational tickets, incidents, and service requests within established SLA response timelines
- Ensure ticket updates, escalations, documentation, and resolution activities comply with contractual SLA requirements
- Perform initial triage and classification of cybersecurity and operational alerts
- Escalate incidents in accordance with operational severity classifications and response procedures
- Assist with incident investigation, event enrichment, and evidence collection activities
- Support ticket management, workflow tracking, and operational documentation within JIRA or equivalent ITSM platforms
- Monitor endpoint, network, cloud, and infrastructure telemetry for indicators of compromise or operational degradation
- Support vulnerability management activities, including Nessus scan review and remediation tracking
- Monitor and support security operations within AWS and Microsoft Azure cloud environments
- Support Appgate Secure Access and Zero Trust access monitoring activities
- Assist with Splunk dashboard monitoring, search analysis, correlation review, and alert validation
- Support operational reporting, metrics collection, SLA tracking, and audit readiness activities
- Maintain situational awareness across connected, degraded, and disconnected operational environments
- Follow established cybersecurity procedures, change control processes, escalation paths, and operational playbooks
- Participate in shift turnover briefings and operational status reporting
- Support coordination activities between NOC, CSOC, engineering, cloud operations, and field support personnel
- Maintain operational logs, incident records, and audit documentation
Work environment:
- 24x7 operational monitoring environment
- Shift-based operations, including nights, weekends, and holidays as required/if required
- SLA-driven operational support environment
- Hybrid operational support across enterprise, cloud, and tactical/disconnected environments
- Collaboration with engineering, cybersecurity, cloud operations, field operations, and customer stakeholders
Required Experience/Qualifications:
- Associate’s degree or Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent experience)
- 0–3 years of cybersecurity, SOC, NOC, cloud operations, service desk, or IT operations experience
- Basic understanding of:
- cybersecurity principles
- networking fundamentals
- TCP/IP
- operating systems
- cloud security concepts
- and security monitoring operations
- Familiarity with cybersecurity and monitoring tools such as:
- Splunk
- Security Onion
- CrowdStrike
- Nessus
- ELK/Elasticsearch
- Appgate
- AWS CloudWatch
- Microsoft Azure Monitor
- or similar technologies
- Basic understanding of:
- SIEM operations
- incident response
- log analysis
- vulnerability management
- cloud monitoring
- ticket management
- and threat detection concepts
- Familiarity with AWS and Microsoft Azure environments
- Experience responding to tickets and working within SLA-driven operational environments preferred
- Ability to follow operational procedures and escalation workflows
- Strong analytical and problem-solving skills
- Effective written and verbal communication skills
- Ability to work rotating shifts in a 24x7 operational environment
Preferred Experience/Qualifications:
- Security+ certification (or ability to obtain within 6 months)
- AWS Certified Cloud Practitioner (preferred)
- Microsoft Azure Fundamentals (AZ-900) certification (preferred)
- Familiarity with:
- NIST frameworks
- RMF
- CMMC
- Zero Trust architectures
- or DoD cybersecurity environments
- Experience with:
- Splunk SIEM
- AWS security services
- Azure security services
- Appgate SDP
- or cloud-native monitoring platforms
- Experience with ticketing systems such as JIRA or ServiceNow
- Exposure to virtualization, endpoint security, or cloud-native security technologies
- Active U.S. Government security clearance (preferred but not required)
Special Requirements/Security Clearance:
- Ability to obtain and maintain a U.S. Government security clearance, if required by contract.
