Cybersecurity SOC Analyst

Job Description

Company: HallieMorgan Technologies

Location: Washington, US

HallieMorgan Technologies is a forward-thinking technology company delivering mission-focused cybersecurity and IT solutions to Federal clients. We specialize in protecting critical infrastructure and high-value systems, combining deep technical expertise with a culture grounded in integrity, accountability, and continuous learning.

Role Description

HallieMorgan Technologies is seeking a highly skilled Cybersecurity SOC Analyst to support a mission-critical environment within DHS. This role goes beyond traditional monitoring and requires a hands-on operator capable of leading real-time incident investigations, conducting advanced threat hunting, and responding to sophisticated adversary activity across both IT and Operational Technology (OT) networks.

Location

Full-time position with hybrid flexibility between on-site work in Washington, D.C. and remote.

Schedule

Shift work required (6AM–2PM / 2PM–10PM), including occasional weekends and special events.

Education & Experience

• Bachelor’s degree in Cybersecurity, Information Technology, or related field (preferred)

• 4+ years of relevant IT or cybersecurity experience

Qualifications

• Active Top Secret clearance; eligibility for TS/SCI required (TS/SCI preferred)

• Strong experience with SIEM platforms (e.g., Elastic/ELK stack) and large-scale log analysis

• Deep understanding of network security monitoring using tools such as Zeek and Suricata

• Proven ability to analyze network traffic, identify anomalies, and detect malicious activity using metadata and packet-level insights

• Experience conducting proactive threat hunting across enterprise environments

• TCP/IP networking and common protocols (DNS, HTTP/S, SMB, RDP)

• Windows and Unix/Linux operating systems

• Enterprise infrastructure (routing, switching, firewalls, proxies, VPNs)

• Understanding of attacker tactics, techniques, and procedures (TTPs), including lateral movement, credential access, command-and-control, and data exfiltration

• Experience analyzing and correlating DNS, proxy, and firewall logs

• Experience analyzing and correlating Authentication logs (Active Directory)

• Experience analyzing and correlating IDS/IPS alerts and packet capture data

• Ability to pivot across indicators of compromise (IPs, domains, hashes, TLS fingerprints such as JA3)

• Familiarity with both IT and OT environments, including segmentation models and potential attack paths between them

• Strong analytical, problem-solving, and communication skills

Key Responsibilities

• Lead triage and investigation of security incidents, including ransomware, suspected data exfiltration, and advanced persistent threats

• Analyze alerts and telemetry to determine scope, impact, and root cause of incidents

• Execute and support containment and response actions while balancing operational and mission requirements

• Conduct advanced threat hunts using network and host-based telemetry to identify stealthy or low-and-slow attacker activity

• Leverage threat intelligence (IOCs, adversary infrastructure, malware behaviors) to proactively identify risks within the environmentPivot across multiple data sources to build a comprehensive attack narrative

• Monitor and investigate activity across both enterprise IT systems and OT environments

• Identify and assess potential attack paths between IT and OT systems, including DMZ traversal and protocol bridging systems

• Support secure operations of critical infrastructure systems while maintaining uptime and safety requirements

• Analyze high-volume datasets to detect anomalies and indicators of compromise

• Develop and refine detection logic, signatures, and use cases within SIEM and IDS/IPS platforms

• Research emerging threats, vulnerabilities, and adversary tactics to improve detection and response capabilities

• Evaluate intelligence feeds, alerts, and reports for relevance to the operational environment

• Contribute to the development and refinement of SOC playbooks, SOPs, and response procedures

• Document findings, timelines, and response actions clearly and concisely

• Communicate technical findings to both technical and non-technical stakeholders

• Provide actionable recommendations to improve overall security posture

Source: JobLeads