Network Security Analyst 1

Job Description – Network Security Analyst 1 Client: Texas Health and Human Services Commission (HHSC) Visa: GC&USC only Position: Network Security Analyst 1 – Security Category: Security Work Arrangement: Onsite – Local Texas Candidates Only Max NTE Rate: $50.00/hour C2C Interview: Microsoft Teams Position Overview HHSC is seeking a Network Security Analyst 1 to support its Cybersecurity Operations Centre (CSOC). The analyst will monitor, triage, investigate, and analyse cybersecurity alerts and suspicious activity across enterprise networks, endpoints, cloud environments, email systems, identity platforms, and security infrastructure. The successful candidate will help identify potential threats, investigate security incidents, document findings, support incident response, and escalate confirmed threats to appropriate cybersecurity teams. Key Responsibilities Monitor and triage cybersecurity alerts from SIEM, EDR/XDR, cloud security, email security, identity protection, and network security platforms. Investigate security events to determine severity, scope, impact, and risk. Identify and prioritize potential cybersecurity incidents. Escalate confirmed threats to Incident Response, Threat Hunting, or SOC Engineering teams. Correlate events from: Endpoints and EDR Firewalls IDS/IPS Cloud services Authentication systems Threat intelligence feeds Investigate indicators of compromise (IOCs), phishing, malware, suspicious network activity, and anomalous user behaviour. Document investigations, findings, and response activities in ticketing/case-management systems. Assist with incident containment, eradication, and recovery. Perform vulnerability assessment reviews and help prioritize remediation. Support alert tuning and reduction of false positives. Maintain SOC procedures, playbooks, workflows, and knowledge-base documentation. Research emerging cyber threats, attack techniques, tactics, and procedures. Required Technical Skills Candidates should have experience with cybersecurity operations and security monitoring technologies, including one or more of the following: SIEM NetWitness Microsoft Sentinel Splunk IBM QRadar ArcSight LogRhythm Microsoft Security Microsoft 365 Defender XDR Microsoft Sentinel Endpoint Security / EDR Microsoft Defender for Endpoint CrowdStrike SentinelOne Network Security IDS/IPS Trellix/FireEye Corelight Firewalls Threat Intelligence VirusTotal Google Threat Intelligence Cisco Talos Recorded Future MISP Vulnerability Management Tenable Qualys Rapid7 Email Security IronPort ESA Abnormal.ai Proofpoint Cloud Security Google Wiz MDCA Cortex Cloud Sysdig SASE Zscaler Prisma Netskope Query & Scripting Skills Experience with security query and scripting languages is valuable, including: KQL SPL Lucene ESQL PowerShell Python Bash Knowledge Required SOC/CSOC operations and best practices Security alert triage and investigation Incident response and escalation Threat detection Malware, phishing, APTs, insider threats, and common attack vectors IOCs and IOAs MITRE ATT&CK Windows and Linux Networking protocols Active Directory Microsoft Entra ID Cloud security environments Enterprise security controls NIST Cybersecurity Framework NIST Incident Response guidance PICERL Required Qualifications The solicitation requires experience in areas such as: Security alert triage Security event analysis Incident investigation and documentation Cybersecurity frameworks Incident response processes Threat detection methodologies Cybersecurity operations Security monitoring Threat detection Security investigations The formal job description calls for 5 years of cybersecurity operations/security monitoring/incident response/threat detection/security investigation experience, while the Candidate Skills and Qualifications table lists 3 years as the minimum requirement for each individual listed competency. Education & Certifications A four-year degree in one of the following is preferred: Cybersecurity Information Security Computer Science Computer Information Systems Management Information Systems Related field Relevant education and experience may substitute for one another. Preferred certifications: CompTIA Security+ GIAC Certified Incident Handler (GCIH) GIAC Certified Intrusion Analyst (GCIA) Certified SOC Analyst (CSA) Microsoft Cybersecurity Analyst (SC-200) Other GIAC or SOC-related certifications Compliance & Submission Requirements Selected candidates will be subject to HHSC requirements including: Background/criminal history investigation E-Verify compliance Acceptable Use Agreement HHSC IT Staff Augmentation Contractor Integrity Agreement (IT Form 4710) HHS Information Security Cybersecurity Training Acknowledgement (Form 3834) Other applicable HHSC/state security requirements Only one candidate may be submitted for this solicitation, and the candidate packet must be merged into a single PDF in this order: Candidate Qualification Form Candidate Resume Candidate Reference Form Candidate Acknowledgement Form Ideal Candidate Profile The strongest candidate will be a SOC/CSOC or Cybersecurity Operations Analyst with hands-on experience in SIEM + EDR + incident response + threat detection, preferably with tools such as Microsoft Sentinel, Defender XDR, CrowdStrike, Splunk, QRadar, or similar platforms. Strong candidates should also demonstrate experience investigating IOCs, correlating security events, using KQL/SPL or similar query languages, documenting incidents, and working within frameworks such as MITRE ATT&CK and NIST.