CBO - Tier 3 SOC Analyst

cFocus Software seeks a Tier 3 SOC Analyst to join our program supporting the Congressional Budget Office (CBO). This position is remote. This position requires a Public Trust clearance.Qualifications:Active Public Trust clearanceB.S. Computer Science, Information Technology, or a related field5+ years of SOC Analyst experienceExpert knowledge of incident response, threat hunting, and detection engineeringAdvanced experience with Microsoft Sentinel (SIEM) and Microsoft Defender toolsStrong understanding of MITRE ATT&CK framework and adversary tacticsExperience with digital forensics and malware analysis techniquesAbility to analyze logs across identity, endpoint, network, and cloud environmentsStrong knowledge of AWS logs (CloudTrail, VPC Flow Logs) and enterprise security toolsExperience with KQL (Kusto Query Language) and advanced correlation analysisDeep understanding of NIST frameworks (800-53, 800-61, 800-92) and Zero Trust principlesExperience with SOAR platforms and automation (Logic Apps, Sentinel playbooks)Experience supporting federal environments and compliance (CUI, FTI, NIST, IRS 1075)Experience leading incident response engagements and reporting to leadershipPreferred certifications include but are not limited toGCIA, GCIH, CISSP, CEH, or equivalent cybersecurity certifications Microsoft Sentinel or Microsoft security platform certifications Relevant cloud security certifications (e.g., AWS security) Privacy certifications (e.g., CIPP/US, CIPM) where applicable Duties:Lead investigation and response for complex and high-severity security incidentsPerform advanced threat hunting using Microsoft Sentinel and Defender platformsConduct digital forensics, malware analysis, and root cause analysis (RCA)Develop, tune, and optimize detection rules, analytics, and correlation logicMap detections and activities to MITRE ATT&CK frameworkOversee incident lifecycle management (detection through containment, eradication, and recovery)Support and improve SOC playbooks, automation workflows, and response proceduresProvide mentorship and guidance to Tier I and Tier II analystsIdentify security control gaps and recommend remediation strategiesSupport red team, purple team, and adversary emulation exercisesContribute to incident reports, quarterly threat reviews, and executive briefings