{"id":3002491,"url":"https://alion.io/job/netrio-level-2-cyber-security-analyst-2","title":"Level 2 Cyber Security Analyst","company":{"id":678445,"name":"Netrio","domain":"netrio.com","url":"https://alion.io/company/netrio","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Rippling","truth_index":{"grade":"A","score":88,"open_postings":7,"ghost_share":0,"stale_share":0.286,"repost_share":0,"time_to_fill_p50_days":69,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["McKinney, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":65000,"max_usd":134000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":325},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CMMC","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Azure","optional":true},{"name":"FedRAMP","optional":true},{"name":"NIST 800-171","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-10-21T11:39:33Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-22T08:24:20Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About Netrio\nNetrio is a leading MSP in North America, specializing in IT solutions for small- to mid-market enterprises. We serve over 1,000 clients across industries with services including managed IT, cybersecurity, cloud, connectivity, voice, and custom application development.\nPosition Summary\nThe SOC Analyst II is a mid-level, hands-on investigative role responsible for deep-dive analysis, incident response, and mentorship of Tier 1 analysts within Netrio's Government SOC. This role aligns to the DoD 8140/DCWF Cyber Defense Analyst (511) work role at an intermediate proficiency level and serves as the primary escalation point for confirmed or suspected security incidents across federal and Defense Industrial Base (DIB) client environments hosted in government-authorized cloud platforms.\nKey Responsibilities\nPerform in-depth investigation of escalated alerts and incidents using SIEM/XDR and EDR platforms\nConduct root-cause analysis, threat correlation, and impact assessment across multi-tenant government client environments\nLead containment, eradication, and recovery actions for confirmed incidents per incident response playbooks\nOwn DFARS 252.204-7012 incident reporting workflow, including 72-hour DIBNet reporting coordination and 90-day data preservation requirements\nPerform threat hunting activities across EDR, SIEM, and identity telemetry (conditional access alerts, sign-in logs)\nMentor and validate escalations from Tier 1 analysts; provide on-shift coaching and quality review of Tier 1 triage decisions\nRefine and author detection use cases, correlation rules, and playbooks based on investigation findings\nCoordinate with client points of contact during active incidents, within defined communication protocols\nSupport endpoint management (RMM) and email security investigations as they intersect with broader incidents\nMaintain and validate chain-of-custody and evidence-handling procedures for CUI-related investigations under CMMC Level 2 / NIST SP 800-171\nParticipate in tabletop exercises, incident response plan reviews, and audit/assessment support (C3PAO readiness activities)\nRequired Qualifications\n2-5 years of experience in a SOC analyst, incident response, or threat hunting role\nDemonstrated experience with at least one SIEM/XDR platform and one EDR platform in a production capacity\nSolid understanding of the cyber kill chain, MITRE ATT&CK framework, and common adversary TTPs\nExperience with log analysis, network traffic analysis, and basic malware/artifact triage\nStrong incident documentation and client communication skills, including under time pressure\nU.S. Citizenship (required for access to government client environments)\nAbility to pass a background investigation as required by client contracts\nRequired Certifications (DoD 8140/DCWF Alignment)\nCompTIA CySA+ and/or GIAC GCIH (Certified Incident Handler). GIAC GCFA (Certified Forensic Analyst) preferred, especially for candidates focused on investigation/forensics depth.\nIf not held at hire, required certification(s) must be obtained within the first 6 months of employment as a condition of continued assignment to government client accounts (DoD 8140 intermediate-level certification requirement).\nPreferred Qualifications\nPrior experience supporting CMMC, FedRAMP, or NIST 800-171/800-53 controlled environments\nExperience in a multi-tenant MSSP or managed detection and response (MDR) setting\nScripting/automation experience (PowerShell, Python) for detection engineering or response automation\nFamiliarity with government cloud administrative constructs (e.g., GCC High, Azure Government, or equivalent)\nExperience mentoring or leading junior analysts\nWork Environment & Physical Requirements\nExtended periods at a workstation monitoring multiple screens/dashboards and investigation tooling\nAbility to work rotating shifts, including nights, weekends, and holidays\nAbility to respond to off-hours pages/alerts during on-call rotation, including leading response for active incidents outside normal working hours\nThis is a 24/7 operational function - reliable attendance and shift punctuality are essential job functions\nThis job requisition is intended to describe the general nature of the work performed. It is not an exhaustive list of all duties, responsibilities, and qualification","description_format":"text","description_chars":4312,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Managed IT Services (MSP)"],"lifecycle":[{"event":"open","at":"2026-10-21T12:40:33Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":69,"reasons":["conf:1","win:early","comp:junior"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/netrio-level-2-cyber-security-analyst-2","json_url":"https://alion.io/job/netrio-level-2-cyber-security-analyst-2.json","meta":{"generated_at":"2026-10-22T08:46:34Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5028,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":678445},"rest":"https://alion.io/mcp/rest/get_company?id=678445"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnetrio-level-2-cyber-security-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnetrio-level-2-cyber-security-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnetrio-level-2-cyber-security-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/netrio-level-2-cyber-security-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnetrio-level-2-cyber-security-analyst-2"}]}