{"id":3188502,"url":"https://alion.io/job/saic-cybersecurity-ops-analyst-2","title":"Cybersecurity Ops Analyst","company":{"id":58788,"name":"SAIC","domain":"saic.com","url":"https://alion.io/company/saic","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":82,"open_postings":57,"ghost_share":0,"stale_share":0.93,"repost_share":0,"time_to_fill_p50_days":18,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Oak Ridge, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":74000,"max_usd":152000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":344},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Splunk","optional":true}],"status":"live","first_seen_at":"2026-10-23T20:21:52Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-26T08:38:18Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"SAIC has an opening for a Cybersecurity Ops Analyst. For the right candidate, SAIC is open to the position working remotely anywhere in the United States.\nThis position will either work 2nd shift (2pm-midnight) or third shift (10pm-8am EST).\nThe SAIC Cybersecurity Ops Analyst performs advanced security event analysis as part of the 24/7/365 Enterprise Security Operations Center (ESOC) Detection & Response team. This role is highly technical and hands-on, using a SIEM and endpoint detection and response (EDR) tools to monitor, analyze, and respond to security events from multiple sources.\nAnalysts are responsible for intrusion detection, incident investigation, triage and initial response, and continuous improvement of detection capabilities and response procedures. They also participate in intelligence gathering and contribute to improving procedures and processes within the ESOC. This position requires independent technical judgment, the ability to investigate complex security events, and collaboration with other cybersecurity teams (GRC, architecture, detection engineer, etc.)\nJob Duties:\nIndependently monitor, triage, and investigate security alerts and anomalous activity, determining severity, scope, potential impact, and appropriate response actions. \nPerform in-depth security investigations by analyzing and correlating network, endpoint, system, and cloud telemetry using SIEM and EDR technologies. Evaluate suspicious activity, threat intelligence, and vulnerability information to identify potential threats and assess organizational risk.\nExecute approved response actions, including IP/URL/Hash blocks, endpoint isolation, and escalate confirmed or suspected incidents to appropriate incident response teams.\nParticipate in proactive threat hunting activities to identify suspicious behavior, indicators of compromise and potential detection gaps.\nDocument investigations, findings, supporting evidence, and response actions accurately and consistently in the incident tracking system. \nContribute to SOC continuous improvement through detection tuning recommendations, process enhancements, and updates to procedures and documentations.\nSupport the onboarding and training of new analysts through knowledge sharing, cross-training, and technical assistance.\n Required Education and Experience:\nBachelor’s degree and 2+ years of experience or an Associate’s degree in related discipline and 3+ years or more experience. An additional 4+ years of experience may be considered in lieu of a degree.\nMust be a US Citizen. \nMust have a minimum 2 years of cybersecurity operations related experience.\nMust possess the following certification(s): Security+ AND CySA+.\nHands-on experience with SIEM and EDR technologies, including security alert investigation, endpoint analysis, and correlation of security events.\nExperience triaging security incidents, assessing severity and potential impact, and determining appropriate escalation procedures. \nWorking knowledge of network security fundamentals and identification of suspicious network activity. \nWorking knowledge of Windows, Linux, and cloud environments, including relevant security logs, events and telemetry. \nUnderstanding of common attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CK framework and its application to security investigations.\nAbility to independently investigate complex or unfamiliar security events, exercise sound technical judgment, and communicate investigative findings. \nStrong written and verbal communication skills, including the ability to clearly document investigations and coordinate with technical and nontechnical stakeholders. \nAbility to effectively share technical knowledge and provide guidance to less experienced analysts.\nPreferred Qualifications:\nHands-on experience with Splunk Enterprise Security (ES).\nExperience participating in the full incident response lifecycles, including containment, eradication, recovery and post-incident analysis.\nExperience conducting proactive threat hunts, identifying detection gaps, and contributing to detection tuning and improvements.\nFamiliarity with scripting or automation using Python, PowerShell, or similar technologies to support security investigations and operational efficiency.","description_format":"text","description_chars":4277,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"associate","optional":false},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Digital Government","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-10-24T00:56:30Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":2,"expected_fill_days":18,"reasons":["conf:2","stale_co","velocity","win:early","comp:junior,brand"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/saic-cybersecurity-ops-analyst-2","json_url":"https://alion.io/job/saic-cybersecurity-ops-analyst-2.json","meta":{"generated_at":"2026-10-26T20:00:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26921,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":58788},"rest":"https://alion.io/mcp/rest/get_company?id=58788"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsaic-cybersecurity-ops-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsaic-cybersecurity-ops-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsaic-cybersecurity-ops-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/saic-cybersecurity-ops-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsaic-cybersecurity-ops-analyst-2"}]}