Security Operations Center (SOC) Analyst - Tier 1 (Secret or TS Clearance)
The Security Operations Center (SOC) Analyst Tier 1 is an entry-level role responsible for continuous monitoring and initial triage of security events using various security tools such as SIEM, EDR, and IDS/IPS. The analyst evaluates alerts, distinguishes false positives from real incidents, escalates confirmed threats, and maintains accurate documentation while supporting 24x7 SOC operations. This position builds foundational cybersecurity skills under close supervision and contributes to incident response and user education within a secure, on-site environment requiring active security clearance.
About Careertakes
👉 Important disclosure: Careertakes is a third-party recruiting platform supporting this hiring process. If selected, you will be employed directly by our client, IT.
Applicants for this role may also receive access to additional matched opportunities through the Careertakes platform.
Compensation & Clearance
Confidential Client is offering a salary range of $65,000–$70,000 per year (based on experience). This position requires an active Secret or Top Secret (TS) clearance. This role is 100% on-site in Boulder, CO. Application deadline: November 30, 2026.
What You’ll Do
The Security Operator I (Tier 1 SOC Analyst) provides continuous monitoring and first-tier triage of security events across the customer environment. Working from established playbooks and SOPs, you will separate false positives from real incidents, document activity, and escalate confirmed or suspected incidents to Tier 2 and incident response teams.
- Monitor SIEM, EDR, IDS/IPS, firewall, email security, and other security consoles in real time
- Perform initial triage of alerts using playbooks and SOPs to classify events (false positive, benign, potential incident)
- Escalate validated or suspected incidents promptly with supporting evidence attached
- Create, update, and close tickets in the case management system with clear, accurate documentation
- Analyze user-reported phishing emails (headers, URLs, attachments) and perform basic threat research on IOCs (IPs, domains, hashes)
- Track investigation status, contribute to shift turnover reports, daily summaries, and SOC metrics
- Follow incident handling, data handling, and chain-of-custody procedures per customer policy and NIST SP 800-61
- Assist with user education on security procedures and report suspicious trends to SOC leadership
- Maintain situational awareness of current threats, vulnerabilities, and attacker techniques relevant to the environment
Required Qualifications
- Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, Information Technology, or a related field
- 0–2 years of relevant experience (internships, labs, and military experience count)
- Active Secret or TS clearance (required)
- DoD 8140 / 8570-compliant baseline certification at IAT Level II or ability to obtain within 6 months (e.g., CompTIA Security+ CE)
- Foundational knowledge of TCP/IP, common ports/protocols, DNS, and basic network architecture
- Working familiarity with Windows and Linux systems and log sources
- Understanding of common attack types (phishing, malware, brute force, lateral movement) and basic incident response lifecycle
- Strong attention to detail and ability to follow procedures consistently
- Clear written and verbal communication skills for documentation and escalations
- Willingness to work rotating shifts, nights, weekends, and holidays as required for 24x7 coverage
Desired / Preferred Skills
- Hands-on experience with Microsoft Sentinel, SentinelOne, or Palo Alto XSOAR
- Exposure to EDR tools (CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne)
- Additional certs: CompTIA CySA+, Network+, GIAC GSEC, Splunk Core Certified User (nice to have)
- Basic scripting/query skills (PowerShell, Python, KQL, or SPL)
- Familiarity with packet analysis (Wireshark)
- Experience with ticketing/case management systems (ServiceNow, Jira)
- Familiarity with federal security frameworks (NIST SP 800-53, NIST SP 800-61, FISMA)
- Prior SOC, NOC, or help-desk experience and hands-on labs (TryHackMe, Hack The Box) are a plus
About Confidential Client
Confidential Client is a customer-focused consulting organization serving federal defense, civilian, and commercial sectors with cybersecurity and enterprise IT services. The company invests in employee growth and professional development and provides a benefits package that may include medical, dental, vision, paid time off, federal holidays, a matching 401(k) plan, and tuition/professional development support.
Equal Opportunity & Hiring Transparency
Careertakes and our client are Equal Opportunity Employers committed to building a diverse and inclusive workforce. We prohibit discrimination or harassment of any kind. To support a fair and efficient hiring process, AI tools may be used to assist with application review or resume screening. These tools do not replace human decision-making. Final hiring decisions are made by people.
If you have questions about how your data is used, please contact us directly.
Negotiate a higher salary! Check the salary ranges for this job type in your area.
View My Salary Range