SOC Analyst Junior

Assists in ensuring the security of the DHMS program's information systems, networks, and data through monitoring, detecting, investigating, analyzing, and responding to cybersecurity incidents and implementing protective measures. Works closely with IT, operations, compliance, and risk management teams to comply with DHMS  IT cybersecurity requirements, policies, and best practices. Possesses fundamental understanding of cybersecurity principles and training or experience in security tools (e.g., firewalls, IDS/IPS), conducting security assessments, developing and implementing mitigation strategies, and incident response.  Capable of developing documentation and knowledge of data security best practices. Must have good problem-solving, analytical, communication, and interpersonal skills and the ability to manage multiple tasks effectively. Demonstrates attention to detail, organizational skills, and ability to work independently and as part of a team. 

• →Monitor security information and event management (SIEM) queues and alerts from firewalls, intrusion detection and prevention systems, and endpoint security tools to identify potentially suspicious activity.
• →Perform initial alert triage by reviewing severity, affected assets, user activity, and supporting evidence to distinguish potential threats from false positives.
• →Review and correlate network, endpoint, and authentication logs to identify suspicious patterns and establish preliminary incident scope and timelines.
• →Follow incident response playbooks, perform authorized initial response actions, and escalate suspected or confirmed incidents with relevant evidence and clear investigation notes.
• →Assist senior analysts with security assessments, documentation of identified weaknesses, and implementation and verification of approved mitigation measures.
• →Maintain accurate incident records covering affected systems, indicators of compromise, investigative steps, response actions, and disposition while following sensitive-data handling requirements.
• →Coordinate with IT, operations, compliance, and risk management teams to support security requirements, communicate findings, and track assigned corrective actions.

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field
• 0–3-years experience in cybersecurity, systems security, or related IT security activities; relevant training or supervised practical experience may support entry-level readiness
• Foundational knowledge of cybersecurity principles, common attack methods, indicators of compromise, and safeguards supporting information confidentiality, integrity, and availability
• Foundational ability to review security alerts and logs, follow incident response procedures, and recognize when findings require escalation to senior analysts
• Strong analytical, problem-solving, written communication, and organizational skills, including the ability to document technical findings accurately and manage multiple assigned tasks
• Must have current Secret clearance
• Must be a U.S. citizen

• Hands-on training or supervised experience using SIEM, firewall, intrusion detection and prevention, or endpoint security tools.
• Experience assisting with security assessments, mitigation verification, or incident documentation in a regulated IT environment.
• Familiarity with coordinating security activities across IT, operations, compliance, and risk management teams.

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age. All decisions on employment are made to abide by the principle of equal employment.

Physical Requirements

The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties' or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.