Security Monitoring / SIEM Analyst

DecisionPoint Corporation is seeking a Security Monitoring / SIEM Analyst to support enterprise cybersecurity operations in a federal and DoD-aligned mission environment. The role focuses on continuous security monitoring, SIEM alert and log analysis, threat detection, incident triage and escalation, reporting, and improving SOC detection capabilities.

Responsibilities:

• Monitor SIEM dashboards and event queues for suspicious or anomalous cybersecurity activity
• Correlate logs from multiple security data sources, including firewalls, endpoints, cloud services, and authentication platforms
• Investigate events and alerts to determine severity, threat likelihood, and required escalation paths
• Support information gathering and preliminary triage for cybersecurity incidents
• Analyze user activity, authentication logs, and system behavior for potential compromise indicators
• Assist with tuning SIEM rules, correlation logic, thresholds, and suppression patterns to improve detection accuracy
• Document security event details, timelines, and investigative findings
• Escalate confirmed or high-risk events to the incident response team with detailed analysis
• Maintain daily and weekly reporting on events, trends, and identified threats
• Participate in continuous monitoring and security operations cycles aligned with DoD RMF requirements
• Contribute to the creation and refinement of SOC playbooks, detection use cases, and monitoring procedures

Requirements:

• Must hold an active Top Secret clearance, supported by a Tier 5 background investigation
• Bachelor's degree in Information Security, Information Technology, Digital Forensics, or a related field
• Minimum 5 years of experience in security monitoring, SOC operations, threat analysis, or cybersecurity investigation
• Experience analyzing logs and events from SIEM platforms
• Experience identifying suspicious activity, anomalous behavior, or indicators of compromise (IOCs)
• Experience correlating data from multiple systems to assess potential threats
• Experience documenting findings and escalating incidents to senior cybersecurity staff
• Strong understanding of SIEM platforms, log aggregation tools, and event correlation
• Knowledge of common attack vectors, threat behaviors, and MITRE ATT&CK techniques
• Familiarity with DoD cybersecurity monitoring, continuous monitoring principles, and incident escalation
• Knowledge of logs produced by operating systems, firewalls, authentication systems, and cloud platforms
• Security+
• Strong analytical, investigative, and problem-solving abilities for assessing security events
• Excellent written and verbal communication skills for summarizing findings and documenting incidents
• Ability to operate in a fast-paced SOC environment and manage multiple active investigations
• High attention to detail for reviewing logs, identifying anomalies, and escalating confirmed threats
• Ability to collaborate effectively with other cybersecurity, engineering, and incident response teams
• Experience tuning SIEM correlation rules or creating new detection logic
• Experience with endpoint detection tools, threat intelligence platforms, or security orchestration workflows
• Familiarity with cloud log monitoring (AWS CloudTrail, GuardDuty, or equivalent)
• CySA+
• Additional DoD 8570/8140 cyber operations certifications