Cyber Defense Analyst – Tier 1

Nightwing

. Monitor customer environments using security technologies to triage alerts and identify potential threats .

Posted 11/11/2026full-timeRemote • Virginia • United StatesJunior💰 $64,000 - $128,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cybersecurity monitoring and incident response, with proficiency in SIEM/XDR platforms and basic artifact analysis. Capable of executing standard operating procedures and maintaining thorough documentation while collaborating effectively with technical teams.

Highest-signal resume keywords

SIEM/XDR Platform ExperienceIncident Response ActivitiesBasic Artifact AnalysisCybersecurity CertificationsNetwork Protocols Understanding

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Basic Log AnalysisEvent CorrelationArtifact AnalysisIncident EscalationAlert TriageSOP ExecutionDocumentation MaintenanceThreat Framework FamiliarityCloud Environment KnowledgeOperating Systems Security

Soft Skills

Effective CommunicationTeam CollaborationCustomer Support

Tools & Technologies

Microsoft SentinelEDR ToolsCase Management ToolsCollaboration ToolsSharePoint

Certifications & Qualifications

CompTIA Security+ISC2 CCCySA+GSECGCIHCISSP Associate

Industry Keywords

CybersecuritySOCNOCThreat IntelligenceIncident ResponseCloud SecurityMITRE ATT&CKCyber Kill ChainTCP/IPDNS

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityDNSGoogle Cloud PlatformLinuxPythonTCP/IP

About the role

Key responsibilities & impact

Monitor customer environments using security technologies to triage alerts and identify potential threats
Compile actionable threat reports and escalate confirmed or suspected threats through appropriate channels
Document security investigations thoroughly in case management tools
Execute standard operating procedures for common alert types
Perform basic artifact analysis involving IP addresses, domains, file hashes, URLs, and email headers
Conduct initial containment actions such as isolating hosts and blocking IPs or domains
Document actions with timestamps and preserve evidence
Process customer communications and fulfill or forward requests
Support teammates during assigned shifts
Maintain shift turnover reports covering outstanding work items and situations
Verify and improve customer access, working with Program Managers toward full access
Convert tribal knowledge into SharePoint articles and shared documentation
Update outdated documentation and maintain the knowledge base
Review weekly Cyber Threat Reports and open-web information to stay current on threats
Attend or review weekly Threat Intelligence briefings
Provide feedback on threat intelligence reports
Document and follow up on Program Management requests
Communicate with Customer Tech Leads and identify alert-tuning opportunities
Communicate with Engineering teams regarding system availability and performance issues

Requirements

What you’ll need

1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC/NOC or similar environment
Hands-on experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage
Experience using endpoint detection and response (EDR) tools for basic investigation and containment
Practical experience triaging alerts, performing basic artifact analysis, and escalating incidents
Exposure to incident response activities, including initial containment, documentation, and coordination with senior analysts
Experience working in a 24x7 or shift-based operational environment
Experience documenting investigations and maintaining accurate tickets/case records
Solid understanding of network protocols and architecture, including TCP/IP, DNS, HTTP/S, VPNs, and common ports/services
Proficiency in basic log analysis and event correlation across endpoint, network, identity, and cloud data sources
Familiarity with MITRE ATT&CK, Cyber Kill Chain, or major threat frameworks
Working knowledge of Windows and Linux operating systems from a security and operations perspective
Familiarity with at least one major cloud environment: Azure, AWS, or GCP
Ability to execute SOPs and runbooks for common alert types and initial containment
Ability to perform basic artifact analysis, including IP addresses, domains, URLs, file hashes, and simple email header review
Comfort using case management and collaboration tools
At least one entry-level cybersecurity certification, such as CompTIA Security+, ISC2 CC, or equivalent
Preferred: 2–4+ years of direct SOC, incident response, or security monitoring experience
Preferred: Advanced experience with Microsoft Sentinel and/or Microsoft security stack
Preferred: Hands-on experience supporting or leading medium- to high-severity incident response
Preferred: Exposure to cloud security monitoring and hardening
Preferred: Experience tuning SIEM/EDR alerts and creating or refining detection use cases
Preferred: Familiarity with Python, PowerShell, KQL, or Bash
Preferred: Experience in client-facing or consulting environments
Preferred: SOC process improvement, documentation, or automation experience
Preferred: Intermediate certifications such as CySA+, GSEC, GCIH, CISSP Associate, or equivalent

Benefits

Comp & perks

Medical insurance coverage
Vision insurance coverage
Dental insurance coverage
401k plan
PTO
Holidays
Additional insurances