Ardent is seeking a Detection & Monitoring Analyst to join our team.
This is a remote position with expected travel to Tallahassee, FL.
Position Description:
Ardent is seeking a Detection & Monitoring Analyst that validates whether authorized test activity generates accurate security telemetry and whether agency detection processes identify, triage, escalate, and document events according to approved criteria. The analyst serves as the defender-side specialist connecting simulated activity to SIEM, EDR, network, identity, and ticketing evidence across a potentially broad multi-agency environment.
Responsibilities and Duties:
- Monitor approved testing activity across SIEM, EDR/XDR, identity, endpoint, network, cloud, and ticketing systems.
- Validate whether expected signals are generated, correlated, enriched, prioritized, and represented accurately in alerts.
- Trace analyst triage, escalation, communications, and handling timelines against OCIG-approved criteria and documented agency expectations.
- Perform alert investigation, packet and network traffic analysis, log correlation, IOC review, malware or phishing analysis when in approved scope, and event-timeline reconstruction.
- Develop or recommend detection logic improvements, use cases, correlation rules, dashboards, and tuning actions while clearly separating recommendations from factual test results.
- Preserve screenshots, alerts, queries, logs, timestamps, ticket records, analyst actions, and annotations in controlled evidence packages.
- Identify telemetry gaps, blind spots, false negatives, inaccurate severity, weak correlation, and broken escalation paths.
- Support vulnerability, remediation, and incident-specific reviews requested through OCIG.
- Help deliver knowledge-transfer sessions on detection validation and evidence interpretation.
Requirements:
- Bachelor’s degree in cybersecurity, information assurance, computer science, or related field, or equivalent SOC experience.
- Proof of relevant professional certifications such as CISSP, CISA, PMP, CEH, or other relevant certifications.
- 4 years of hands-on SOC, detection engineering, intrusion analysis, continuous monitoring, incident response, network security, or threat-hunting experience.
- Experience with SIEM and EDR/XDR platforms, log query languages, network telemetry, MITRE ATT&CK mapping, case management, and incident escalation.
- Ability to document expected versus observed results precisely and maintain evidence integrity.
- Knowledge of NIST CSF Detect outcomes and access-control telemetry.
Preferred Qualifications:
- SIEM content development, detection-as-code, or security analytics experience.
- Experience with cloud-native logging, identity telemetry, SOAR, packet capture, threat intelligence, and forensic investigation.
- Zero Trust monitoring or FedRAMP continuous-monitoring experience.
- Government SOC or regulated-sector experience.
Due to the nature of the work we support, all candidates in consideration for this role must be willing to undergo the government issued background investigation process.
Ardent is an equal opportunity employer. We will not discriminate in employment, recruitment, advertisements for employment, compensation, termination, upgrading, promotions, and other conditions of employment against any employee or job applicant on the bases of race, color, gender, national origin, age, religion, creed, disability, veteran's status, sexual orientation, gender identity, gender expression, or any other basis protected by state, local, or federal law.