Remote Cyber Defense Analyst Jobs
Remote cyber defense analyst jobs are open across the U.S. at remote-first firms and distributed security teams in defense contracting, financial services, healthcare, and technology. Employers hiring remotely right now include Nightwing, Dexcom, and Google. See the openings below and apply to the ones that match your experience.
Find JobsOverview
Showing 5 of 7+ Remote Cyber Defense Analyst jobs
Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers’ most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.
Location: Remote
1.0 Role Description
The Cyber Defense Analyst is responsible for monitoring, triaging, and providing first response to security alerts across VSOC customer environments, using various security tools to distinguish meaningful threats from background noise while carefully documenting investigations and analyzing events for signs of true positive threats. They work closely with fellow analysts, sharing findings and leveraging senior colleagues’ expertise to deepen their analysis, determine the appropriate severity of each situation, and promptly escalate issues to the right stakeholders. At the end of each shift, they clearly communicate outstanding items and tasks to the incoming team to ensure continuity of operations and effective SOC performance.
Responsibilities
1.1 Primary Responsibilities
Protect and Defend:
- Monitor Customer Environments - Leverage the customer's security technologies to triage security alerts and identify potential threats.
- Escalate confirmed or suspected Threats - Compile an actionable report that describes a threat to the customer environment and escalate through the appropriate channels.
- Document Investigations - Record security investigation efforts in a thorough manner that allows for easy peer review and collaboration through the appropriate case management tool.
Incident Response:
- Execute standard operating procedures (SOPs) for common alert types
- Perform basic artifact analysis (IP addresses, domains, file hashes)
- Conduct initial containment actions (isolating hosts, blocking IPs) per runbooks
- Document all actions taken with timestamps and evidence preservation
Communicate and Collaborate:
- Acknowledge and handle Customer Requests - Process communications from assigned customers and fulfill (or forward) the tasks as appropriate.
- Support your Shift - Be available to your teammates while on shift and ready to assist them at all times.
- Improve SOC Situational Awareness - Use the Shift Turnover Report to note outstanding work items, tasks and situations that the following shifts should be aware of.
1.2 Secondary Responsibilities
Maintain SOC Readiness:
- Verify and Improve Customer Access - Take responsibility of your overall access situation and work with the Program Managers to achieve 100% access across all customers.
- Identify and Fill knowledge gaps - Convert localized tribal knowledge into global shared knowledge through SharePoint articles and documents for the entire SOC to benefit from.
- Update outdated documentation - Take stock of currently existing documentation and change the information as necessary to keep the knowledge base current.
Continuous Development:
- Keep up-to-date on Threat Landscape - Review Threat Intelligence's weekly Cyber Threat Reports and crawl the open web to learn about contemporary threats to our environments.
- Hone Blue Team skills - Seek out challenges and trainings to improve your Analysis skillset.
- Get Creative - Take a proactive approach to problems encountered in your career and consider possible solutions you or the team can implement to overcome them.
2.0 Role Integrations
2.1 Collaboration with the Intelligence Team
Purpose
The Intelligence team provides the Tier 1 Cyber Security Analyst situational updates on the ever-changing Cyber Threat Landscape regularly. T1 Analyst should seek to leverage the knowledge provided to improve their contextual awareness for threats in their daily monitoring duties.
Requirements
- Stay Appraised: Attend weekly Threat Intelligence briefings (or download the recording/slides of the briefings) regularly to stay up-to-date on the latest changes to the Cyber Threat Landscape.
- Feedback Loop: Provide feedback to the intelligence team on the effectiveness and accuracy of the threat intelligence reports received. Share insights and observations from working with the threat hunting content and highlight any areas where additional or more specific information would be beneficial for improving the content's accuracy and relevance.
2.2 Collaboration with the Program Management Team
Purpose
The Program Management team handles the majority of the VSOC’s administrative duties for our customer environments. Tier 1 Cyber Security Analysts should leverage the PM team to gain further insight into what their customer environments need from them as well for handling clerical tasks (such as requesting access for customer tools)
Requirements
- Regular Communication: Request for the Program Management team must be documented in our case management system and frequently followed-up on in order to maintain momentum and prevent important tasks from falling off the PM’s radar.
- Self-Accountability (Access : Customer access is a core requirement of the T1 Analysts role in the VSOC and often takes time to restore once lost. VSOC Analysts must regularly verify and maintain their access to prevent long periods of downtime as the result of access loss.
2.3 Collaboration with the Customer Tech Leads
Purpose
Customer Technology Leads (formerly known as Client Leads) serve as the operational SME of a customer environment. Cyber Defense Analysts will interface with these leads in order to address environmental concerns (such alert tuning or customer requests).
Requirements
- Regular Communication: T1 Analysts who are assigned to customer environments should be aware of who the relevant Customer Tech Leads are and be ready to open lines of communication with them to raise concerns or ask questions to help them on their Threat Monitoring duties.
- Identify Tuning Opportunities: Many alerts worked by T1 Analysts often result in false positive/benign results that generate unnecessary noise in a customer environment. T1 Analysts should help mitigate the noise by identifying these noisy alerts and informing the Customer Tech Lead of tuning opportunities through Tuning Requests.
2.4 Collaboration with the Engineering Team
Purpose
The Engineering team maintains the availability of the majority of the VSOC’s customer environments. Cyber Defense Analysts interface with technologies that Engineering teams maintain and relay any issues in availability and performance so that Engineering can resolve them in a timely manner.
Requirements
- Regular Communication: T1 Analysts who are assigned to customer environments should be aware of who the relevant Engineers are and be ready to open lines of communication with them to raise issues that impact system availability or performance.
Identify Tuning Opportunities: Many alerts worked by T1 Analysts often result in false positive/benign results that generate unnecessary noise in a customer environment.
3.0 Qualifications
3.1 Mandatory Requirements
3.1.1 Experience
- 1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC/NOC or similar environment.
- Hands-on experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage.
- Experience using endpoint detection and response (EDR) tools for basic investigation and containment.
- Practical experience triaging alerts, performing basic artifact analysis, and escalating incidents.
- Exposure to incident response activities (initial containment, documentation, coordination with senior analysts).
- Experience working in a 24x7 or shift-based operational environment.
- Experience documenting investigations and maintaining accurate tickets/case records.
3.1.2 Technical Skills
- Solid understanding of network protocols and architecture (TCP/IP, DNS, HTTP/S, VPNs, common ports/services).
- Proficiency in basic log analysis and event correlation across multiple data sources (endpoint, network, identity, cloud).
- Familiarity with major threat frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain) and their practical application.
- Working knowledge of Windows and Linux operating systems from a security and operations perspective.
- Familiarity with at least one major cloud environment (Azure, AWS, or GCP) and its core security concepts.
- Ability to execute SOPs and runbooks for common alert types and initial containment (host isolation, blocking IPs/domains).
- Ability to perform basic artifact analysis (IP addresses, domains, URLs, file hashes, simple email header review).
- Comfortable using case management and collaboration tools to track and share investigation details.
3.1.3 Key Competencies
- Proactive and self-motivated approach to monitoring, investigation, and continuous improvement.
- Strong analytical and problem-solving skills applied to alert triage and incident assessment.
- High attention to detail and accuracy in documentation, evidence handling, and severity assessment.
- Excellent written communication skills for clear, concise tickets, incident notes, and handover reports.
- Effective verbal communication skills for collaboration with teammates and cross-functional partners.
- Ability to work under pressure during active security incidents while maintaining composure and quality.
- Team-oriented mindset with strong collaboration and knowledge-sharing habits.
- Continuous learning attitude, staying current with evolving threats, tools, and best practices.
- At least one entry-level cybersecurity certification (e.g., CompTIA Security+, ISC2 CC, or equivalent).
3.2 Preferred Qualifications
- 2–4+ years of direct SOC, incident response, or security monitoring experience.
- Advanced experience with Microsoft Sentinel and/or Microsoft security stack (Defender, M365, Entra ID).
- Hands-on experience supporting or leading incident response for medium to high-severity events.
- Exposure to cloud security monitoring and hardening (Azure, AWS, or GCP).
- Experience tuning SIEM/EDR alerts and creating or refining detection use cases.
- Familiarity with scripting or automation (Python, PowerShell, KQL, Bash) to support investigations.
- Experience working in client-facing or consulting environments.
- Prior involvement in SOC process improvements, documentation, or automation initiatives.
One or more intermediate certifications (e.g., CySA+, GSEC, GCIH, CISSP Associate, or equivalent).
Salary & Benefits
The salary associated with this position ($64,000-$128,000) is commensurate with the selected candidate’s qualifications, years of relevant experience, and demonstrated level of expertise. Compensation will be determined based on these factors to ensure alignment with skills, responsibilities, and market standards.
Nightwing offers medical, vision and dental insurance coverage in addition to a 401k plan, PTO, Holidays, and additional insurances.
Nightwing is An Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class.
Nightwing provides technically advanced full-spectrum cyber, data operations, systems integration and intelligence mission support services to meet our customers’ most demanding challenges. Our capabilities include cyber space operations, cyber defense and resiliency, vulnerability research, ubiquitous technical surveillance, data intelligence, lifecycle mission enablement, and software modernization. Nightwing brings disruptive technologies, agility, and competitive offerings to customers in the intelligence community, defense, civil, and commercial markets.
Location: Remote
1.0 Role Description
The Cyber Defense Analyst is responsible for monitoring, triaging, and providing first response to security alerts across VSOC customer environments, using various security tools to distinguish meaningful threats from background noise while carefully documenting investigations and analyzing events for signs of true positive threats. They work closely with fellow analysts, sharing findings and leveraging senior colleagues’ expertise to deepen their analysis, determine the appropriate severity of each situation, and promptly escalate issues to the right stakeholders. At the end of each shift, they clearly communicate outstanding items and tasks to the incoming team to ensure continuity of operations and effective SOC performance.
Responsibilities
1.1 Primary Responsibilities
Protect and Defend:
- Monitor Customer Environments - Leverage the customer's security technologies to triage security alerts and identify potential threats.
- Escalate confirmed or suspected Threats - Compile an actionable report that describes a threat to the customer environment and escalate through the appropriate channels.
- Document Investigations - Record security investigation efforts in a thorough manner that allows for easy peer review and collaboration through the appropriate case management tool.
Incident Response:
- Execute standard operating procedures (SOPs) for common alert types
- Perform basic artifact analysis (IP addresses, domains, file hashes)
- Conduct initial containment actions (isolating hosts, blocking IPs) per runbooks
- Document all actions taken with timestamps and evidence preservation
Communicate and Collaborate:
- Acknowledge and handle Customer Requests - Process communications from assigned customers and fulfill (or forward) the tasks as appropriate.
- Support your Shift - Be available to your teammates while on shift and ready to assist them at all times.
- Improve SOC Situational Awareness - Use the Shift Turnover Report to note outstanding work items, tasks and situations that the following shifts should be aware of.
1.2 Secondary Responsibilities
Maintain SOC Readiness:
- Verify and Improve Customer Access - Take responsibility of your overall access situation and work with the Program Managers to achieve 100% access across all customers.
- Identify and Fill knowledge gaps - Convert localized tribal knowledge into global shared knowledge through SharePoint articles and documents for the entire SOC to benefit from.
- Update outdated documentation - Take stock of currently existing documentation and change the information as necessary to keep the knowledge base current.
Continuous Development:
- Keep up-to-date on Threat Landscape - Review Threat Intelligence's weekly Cyber Threat Reports and crawl the open web to learn about contemporary threats to our environments.
- Hone Blue Team skills - Seek out challenges and trainings to improve your Analysis skillset.
- Get Creative - Take a proactive approach to problems encountered in your career and consider possible solutions you or the team can implement to overcome them.
2.0 Role Integrations
2.1 Collaboration with the Intelligence Team
Purpose
The Intelligence team provides the Tier 1 Cyber Security Analyst situational updates on the ever-changing Cyber Threat Landscape regularly. T1 Analyst should seek to leverage the knowledge provided to improve their contextual awareness for threats in their daily monitoring duties.
Requirements
- Stay Appraised: Attend weekly Threat Intelligence briefings (or download the recording/slides of the briefings) regularly to stay up-to-date on the latest changes to the Cyber Threat Landscape.
- Feedback Loop: Provide feedback to the intelligence team on the effectiveness and accuracy of the threat intelligence reports received. Share insights and observations from working with the threat hunting content and highlight any areas where additional or more specific information would be beneficial for improving the content's accuracy and relevance.
2.2 Collaboration with the Program Management Team
Purpose
The Program Management team handles the majority of the VSOC’s administrative duties for our customer environments. Tier 1 Cyber Security Analysts should leverage the PM team to gain further insight into what their customer environments need from them as well for handling clerical tasks (such as requesting access for customer tools)
Requirements
- Regular Communication: Request for the Program Management team must be documented in our case management system and frequently followed-up on in order to maintain momentum and prevent important tasks from falling off the PM’s radar.
- Self-Accountability (Access : Customer access is a core requirement of the T1 Analysts role in the VSOC and often takes time to restore once lost. VSOC Analysts must regularly verify and maintain their access to prevent long periods of downtime as the result of access loss.
2.3 Collaboration with the Customer Tech Leads
Purpose
Customer Technology Leads (formerly known as Client Leads) serve as the operational SME of a customer environment. Cyber Defense Analysts will interface with these leads in order to address environmental concerns (such alert tuning or customer requests).
Requirements
- Regular Communication: T1 Analysts who are assigned to customer environments should be aware of who the relevant Customer Tech Leads are and be ready to open lines of communication with them to raise concerns or ask questions to help them on their Threat Monitoring duties.
- Identify Tuning Opportunities: Many alerts worked by T1 Analysts often result in false positive/benign results that generate unnecessary noise in a customer environment. T1 Analysts should help mitigate the noise by identifying these noisy alerts and informing the Customer Tech Lead of tuning opportunities through Tuning Requests.
2.4 Collaboration with the Engineering Team
Purpose
The Engineering team maintains the availability of the majority of the VSOC’s customer environments. Cyber Defense Analysts interface with technologies that Engineering teams maintain and relay any issues in availability and performance so that Engineering can resolve them in a timely manner.
Requirements
- Regular Communication: T1 Analysts who are assigned to customer environments should be aware of who the relevant Engineers are and be ready to open lines of communication with them to raise issues that impact system availability or performance.
Identify Tuning Opportunities: Many alerts worked by T1 Analysts often result in false positive/benign results that generate unnecessary noise in a customer environment.
3.0 Qualifications
3.1 Mandatory Requirements
3.1.1 Experience
- 1–2+ years of experience in cybersecurity, IT operations, or security monitoring in a SOC/NOC or similar environment.
- Hands-on experience with at least one SIEM/XDR platform (e.g., Microsoft Sentinel or equivalent) for alert monitoring and triage.
- Experience using endpoint detection and response (EDR) tools for basic investigation and containment.
- Practical experience triaging alerts, performing basic artifact analysis, and escalating incidents.
- Exposure to incident response activities (initial containment, documentation, coordination with senior analysts).
- Experience working in a 24x7 or shift-based operational environment.
- Experience documenting investigations and maintaining accurate tickets/case records.
3.1.2 Technical Skills
- Solid understanding of network protocols and architecture (TCP/IP, DNS, HTTP/S, VPNs, common ports/services).
- Proficiency in basic log analysis and event correlation across multiple data sources (endpoint, network, identity, cloud).
- Familiarity with major threat frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain) and their practical application.
- Working knowledge of Windows and Linux operating systems from a security and operations perspective.
- Familiarity with at least one major cloud environment (Azure, AWS, or GCP) and its core security concepts.
- Ability to execute SOPs and runbooks for common alert types and initial containment (host isolation, blocking IPs/domains).
- Ability to perform basic artifact analysis (IP addresses, domains, URLs, file hashes, simple email header review).
- Comfortable using case management and collaboration tools to track and share investigation details.
3.1.3 Key Competencies
- Proactive and self-motivated approach to monitoring, investigation, and continuous improvement.
- Strong analytical and problem-solving skills applied to alert triage and incident assessment.
- High attention to detail and accuracy in documentation, evidence handling, and severity assessment.
- Excellent written communication skills for clear, concise tickets, incident notes, and handover reports.
- Effective verbal communication skills for collaboration with teammates and cross-functional partners.
- Ability to work under pressure during active security incidents while maintaining composure and quality.
- Team-oriented mindset with strong collaboration and knowledge-sharing habits.
- Continuous learning attitude, staying current with evolving threats, tools, and best practices.
- At least one entry-level cybersecurity certification (e.g., CompTIA Security+, ISC2 CC, or equivalent).
3.2 Preferred Qualifications
- 2–4+ years of direct SOC, incident response, or security monitoring experience.
- Advanced experience with Microsoft Sentinel and/or Microsoft security stack (Defender, M365, Entra ID).
- Hands-on experience supporting or leading incident response for medium to high-severity events.
- Exposure to cloud security monitoring and hardening (Azure, AWS, or GCP).
- Experience tuning SIEM/EDR alerts and creating or refining detection use cases.
- Familiarity with scripting or automation (Python, PowerShell, KQL, Bash) to support investigations.
- Experience working in client-facing or consulting environments.
- Prior involvement in SOC process improvements, documentation, or automation initiatives.
One or more intermediate certifications (e.g., CySA+, GSEC, GCIH, CISSP Associate, or equivalent).
Salary & Benefits
The salary associated with this position ($64,000-$128,000) is commensurate with the selected candidate’s qualifications, years of relevant experience, and demonstrated level of expertise. Compensation will be determined based on these factors to ensure alignment with skills, responsibilities, and market standards.
Nightwing offers medical, vision and dental insurance coverage in addition to a 401k plan, PTO, Holidays, and additional insurances.
Nightwing is An Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status, age or any other federally protected class.
See All 7 Remote Cyber Defense Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsRemote Cyber Defense Analyst Job Market
Who's Hiring
What Employers Look For
The qualifications that appear most often in remote cyber defense analyst jobs.
- Active or eligibility for DoD Secret or Top Secret security clearance
- Proficiency with SIEM platforms such as Splunk or Microsoft Sentinel
- CompTIA Security+ or equivalent DoD 8570 baseline certification
- Experience with endpoint detection and response tools like CrowdStrike or Carbon Black
- Bachelor's degree in cybersecurity, computer science, or a related field
- Familiarity with MITRE ATT&CK framework and threat intelligence analysis
Tips for Your Remote Cyber Defense Analyst Job Search
Apply early to remote roles that fit
Migrate Mate lists remote cyber defense analyst openings from across the U.S. in one place, so you can find roles that match your skills and apply directly without sorting through unrelated postings.
Show your async incident documentation skills
Remote security teams depend on written documentation for every alert triage, escalation, and post-incident review. Include writing samples or redacted incident reports in your application materials to show you can communicate clearly without real-time collaboration.
Build a home lab with remote-relevant tooling
Remote cyber defense analyst roles expect fluency with SIEM platforms, EDR tools, and cloud-based threat intelligence feeds from day one. A documented home lab using tools like Splunk, Elastic SIEM, or open-source IDS platforms gives hiring managers concrete evidence of your independent technical capability.
Prepare for async-first remote interviews
Many remote security teams use asynchronous screening steps, including recorded video responses or written technical scenarios, before live interviews. Practice explaining your detection methodology and triage decisions in writing so your reasoning is clear without back-and-forth clarification.
Remote Cyber Defense Analyst Jobs: Frequently Asked Questions
How do I get a remote cyber defense analyst job?
Target companies with established remote security operations, including cloud-native firms, managed security service providers, and distributed defense contractors that run 24/7 SOC coverage across time zones. Remote employers screen heavily for self-direction, clear written communication for async incident documentation, and hands-on skills in SIEM platforms, endpoint detection tools, and threat intelligence workflows. Certifications like Security+, CySA+, or CEH signal readiness to work independently from day one.
Which companies hire remote cyber defense analysts?
Employers currently hiring remote cyber defense analysts include Nightwing, Dexcom, and Google, per current remote listings on Migrate Mate as of November 2026. Remote-first firms, managed security service providers, and distributed defense contractors across technology, financial services, and federal contracting tend to hire this role for fully remote positions.
Can you get a remote cyber defense analyst job with no experience?
Yes, but remote entry-level cyber defense analyst roles are harder to land because employers expect you to investigate alerts and document findings with minimal in-person oversight from day one. Cloud security labs, home SOC projects, and virtual internships with managed security providers can substitute for formal experience. Candidates who demonstrate async communication skills and show documented lab work in SIEM or intrusion detection tools open more doors remotely than those without evidence of independent work.
Do you need a degree for remote cyber defense analyst jobs?
Not always. Remote employers increasingly weigh practical skills, certifications like CySA+, Security+, or GCIA, and demonstrated hands-on experience over a formal degree. Candidates who can show real detection, triage, and response work, whether through labs, prior roles, or documented projects, are competitive even without a four-year degree. Some federal contracting roles do require specific educational backgrounds, so check each posting carefully.
See All 7 Remote Cyber Defense Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs