{"id":3545091,"url":"https://alion.io/job/jcs-solutions-security-operations-center-soc-analyst-jcs-solutions-llc","title":"Security Operations Center (SOC) Analyst - JCS Solutions LLC","company":{"id":3854787,"name":"JCS Solutions","domain":"jcssolutions.com","url":"https://alion.io/company/jcs-solutions","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"JazzHR","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Alexandria, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":75000,"max":130000,"currency":"USD","period":"year","gross":null,"usd_annual":130000},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Discord","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Slack","optional":false},{"name":"Splunk","optional":false},{"name":"TCP/IP","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-30T20:30:49Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-01T17:47:20Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Grow, innovate, and generate progress: Harness your expertise to solve challenges and celebrate success!\nJob Summary\nJCS Solutions is seeking a Security Operations Center (SOC) Analyst supporting the Pentagon Reservation under the DISA Penetration Handling, Incident, System Health (PHISH) Support Services II program. This position supports a 24/7 SOC mission and requires availability for rotating shifts, including weekends, holidays, and inclement-weather operations. The position requires 60 percent onsite work at the Mark Center in Alexandria, Virginia, consistent with program and customer requirements.\nThe Security Operations Center (SOC) Analyst supports continuous monitoring, detection, analysis, escalation, mitigation, and response to cybersecurity events affecting customer networks, endpoints, servers, applications, cloud environments, and mission systems. The analyst uses security telemetry, threat intelligence, established analytic procedures, and operational tools to identify suspicious or malicious activity; investigate potential compromises; document findings; and coordinate response actions with senior analysts, incident responders, cyber engineers, system owners, and mission partners.\nThis role is an experienced technical individual-contributor position. The SOC Analyst works independently to achieve day-to-day operational objectives and may own defined projects or technical processes within the SOC. The analyst contributes to operational cybersecurity, infrastructure support, and mission-support activities; collaborates with internal subject-matter experts to resolve technical problems; and may provide peer support, coaching, or technical review for less-experienced personnel.\nLocation: Alexandria, VA\nClearance: TS/SCI\nCertification: Active DoD 8140/8570 IAT Level II certification\nWhat’s in it for you:\nJoin a premier technology firm specializing in innovative solutions. \nBe part of a collaborative, inclusive, and innovative work culture. \nEnjoy tremendous growth potential in a high-performing team environment. \nA robust benefits package: Health, dental, and vision insurance \nLife insurance \nShort-and-long term disability \nPaid time off (PTO) \n401k retirement plan with employer match \nAnnual Professional Development Reimbursement Program \nAnd more! \n\nWhat you will do:\nMonitor, triage, and investigate alerts from Security Information and Event Management (SIEM) platforms, Endpoint Detection and Response (EDR) tools, intrusion detection and prevention systems (IDS/IPS), authentication logs, NetFlow, packet capture, cloud-security tools, vulnerability data, and other available security sensors. \nAnalyze endpoint, host, network, identity, application, and cloud telemetry to identify anomalous, suspicious, or malicious activity. \nConduct assigned incident investigations by reviewing security logs and alerts, correlating evidence across available data sources, identifying potentially affected systems or accounts, assessing scope and potential impact, and escalating cases in accordance with established procedures. \nApply cyber threat intelligence and knowledge of adversary tactics, techniques, and procedures (TTPs) to validate alerts, identify indicators of compromise, prioritize investigations, and provide relevant context to incident responders and technical stakeholders. \nSupport approved containment, eradication, recovery, and post-incident activities by collecting evidence, documenting actions, validating security controls, and coordinating with designated response personnel. \nPerform computer forensic network and host analysis in support of incident investigations, threat-hunting activities, and evidence-based reporting. \nSupport proactive threat hunts, environment sweeps, and detection-validation activities based on known or emerging adversary activity, vulnerabilities, and organizational priorities. \nIdentify recurring false positives, control gaps, telemetry limitations, suspicious trends, vulnerabilities, and adversary behaviors; recommend improvements to detection logic, dashboards, analytic workflows, playbooks, and SOC processes. \nContribute to the development, testing, tuning, and documentation of detection use cases, correlation logic, analytic playbooks, standard operating procedures, work instructions, and knowledge-management artifacts. \nDocument analytic methods, evidence, findings, actions taken, escalation decisions, and recommended next steps in case-management and knowledge-management systems. \nPrepare clear incident tickets, shift summaries, situational-awareness updates, and technical reports for SOC personnel, incident responders, system owners, and operational stakeholders. \nConduct authorized infrastructure-support activities, including device discovery, operating-system fingerprinting, service scanning, passive network scanning, and support to the configuration, testing, deployment, and maintenance of cybersecurity hardware and software. \nMaintain proficiency with operational tools, cyber-defense methodologies, network and host analysis techniques, and evolving threats. \nSupport training, exercises, operational planning, and integrated cyber operations as assigned. \nCollaborate with SOC operations, incident response, cyber engineering, threat intelligence, system administrators, and mission partners to share findings and support timely remediation. \nProvide technical guidance, peer review, and knowledge sharing to junior analysts or other team members, as assigned. \nWhat you will bring:Experience supporting a SOC, CND organization, cyber protection team, incident-response team, network operations center, or comparable cybersecurity operations environment. \nExperience monitoring and investigating cybersecurity events using SIEM, EDR, IDS/IPS, endpoint, network, identity, cloud, vulnerability, and log-data sources. \nWorking knowledge of incident-response processes, including alert triage, investigation, escalation, evidence collection, containment support, remediation coordination, and incident documentation. \nWorking knowledge of TCP/IP; common ports and protocols; network traffic flow; endpoint and operating-system fundamentals; authentication and identity activity; and enterprise security controls. \nFamiliarity with adversary TTPs, attack vectors, indicators of compromise, common malware behaviors, and analytic frameworks such as MITRE ATT&CK and the Cyber Kill Chain. \nAbility to analyze available data, identify gaps or uncertainties, apply established procedures, and communicate technically sound findings and recommendations. \nAbility to prepare clear case notes, incident summaries, shift-turnover products, and technical reports for technical and operational audiences. \nAbility to collaborate effectively across SOC operations, incident response, cyber engineering, system administration, and customer or mission-partner organizations. \nAbility to work independently on assigned operational objectives, technical processes, or projects, while recognizing when to seek assistance or escalate risk. \n Required CertificationsAn active DoD 8140 IAT Level II certification, such as one of the following: Security+ CE, CySA+, CASP+ CE, CCNA-Security, CCNP Security, CCSP, CISA, CISSP (or Associate), CND, GCED, GCIH, GICSP, GSEC, or SSCP\n\nEducation RequirementsBachelor’s degree in cybersecurity, information technology, computer science, intelligence studies, or a related technical discipline, and 4-8 years of relevant experience; or an equivalent combination of relevant military service, cybersecurity education, certifications, and professional experience. \n\n How you will wow us:Experience using one or more enterprise SIEM platforms, such as Splunk, Microsoft Sentinel, IBM QRadar, ArcSight, Elastic, or comparable tools. \nExperience with EDR, antivirus, host-based security tools, IDS/IPS, network detection and response, vulnerability-management tools, NetFlow, or packet-capture analysis. \nFamiliarity with Windows and Unix/Linux operating systems, command-line tools, and system-administration concepts. \nExperience with structured threat hunting, detection tuning, use-case development, or translating threat intelligence into analytic queries. \nFamiliarity with malicious-file triage, malware-analysis concepts, network-forensics techniques, or host-forensics artifacts. \nExperience with scripting or automation using Python, PowerShell, Bash, or a similar language. \nRelevant cybersecurity certification(s), including those required by the applicable contract, customer, or Department of War policy. \nJCS Solutions (JCS) is a premier technology firm providing innovative solutions and high-quality services in defense, national security, and civilian sectors. JCS offers enterprise-wide solutions including cloud computing, software development, cybersecurity, digital modernization, and management consulting for the federal government.\nAt JCS, we elevate our customers’ mission through the application of technology and professional services. Our commitment to investing in our workforce drives innovation and progress for our clients, employees, and communities.\nJCS is both a Great Place to Work and a Top Places to Work certified company.\nOur employees embody our core values, and we are looking for others who do too!\nCustomer Experience: Strive for excellence and delight our clients \nInnovation: Embrace creative thinking to enable continual growth and powerful solutions \nAccountability: Take ownership of and pride in our actions and service delivery \nInspire: Be inspired to be your best self and have fun in the process \nIntegrity: Do the right thing, the right way, every time! \nStewardship: The careful and responsible management of something entrusted to our care. \nAt JCS Solutions, compensation is based on a number of factors such as location, qualifications, and applicable contract terms. The general salary range for this position is as follows: $75,000.00 - $130,000.00Commitment to Non-Discrimination\nAll qualified applicants will receive consideration for employment without regard to any protected status protected by applicable federal, state, or local laws.\nNOTICE: Please be aware that all JCS Solutions communications related to job interviews and offers from our recruiting team will only come from @JCSSolutions.com. We want to emphasize that we do not conduct any interviews over Discord, Slack, Skype, Zoom, or any chat app.","description_format":"text","description_chars":10430,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["401k plan","Life insurance","Professional development","Retirement plans","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","IT Help Desk & Service Desk","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-30T20:30:49Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":16,"reasons":["conf:6","velocity","win:early"],"computed_at":"2026-11-01T06:10:25Z"},"pay":{"stated_usd_annual":130000,"is_top_pay":true},"html_url":"https://alion.io/job/jcs-solutions-security-operations-center-soc-analyst-jcs-solutions-llc","json_url":"https://alion.io/job/jcs-solutions-security-operations-center-soc-analyst-jcs-solutions-llc.json","meta":{"generated_at":"2026-11-01T19:57:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30724,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3854787},"rest":"https://alion.io/mcp/rest/get_company?id=3854787"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fjcs-solutions-security-operations-center-soc-analyst-jcs-solutions-llc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fjcs-solutions-security-operations-center-soc-analyst-jcs-solutions-llc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fjcs-solutions-security-operations-center-soc-analyst-jcs-solutions-llc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/jcs-solutions-security-operations-center-soc-analyst-jcs-solutions-llc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fjcs-solutions-security-operations-center-soc-analyst-jcs-solutions-llc"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3545091}},{"tool":"search_jobs","arguments":{"company":"jcssolutions.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3545091},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}