Description
Leidos is seeking a Cyber Defense Analyst to join a mission-focused team supporting the Navy's cybersecurity environment in Suitland, MD.
In this role, you will serve on the front line of cyber defense, helping protect critical TS/SCI networks by monitoring and investigating cybersecurity alerts, identifying potential threats, and supporting proactive threat hunting activities.
Primary Responsibilities
- Perform first-line monitoring of security tools and conduct initial analysis of alerts for TS/SCI networks, including JWICS, ATLAS, and other networks.
- Monitor organisational cybersecurity tools for alerts, anomalies, and indicators of compromise.
- Investigate and perform initial technical analysis of cybersecurity alerts and events, escalating potential incidents to Tier 2 as appropriate.
- Create, update, and manage incident and event tickets within the approved ticketing system.
- Conduct proactive threat hunting activities to identify potential malicious activity and emerging threats.
- Perform wireless security scans of facilities and document and report findings.
- Correlate alerts and security events across multiple platforms to identify patterns, trends, and potential threats.
- Prepare and deliver operational and situational awareness briefings.
- Support annual cyber defence exercises.
Required Qualifications
- Bachelor's degree in Cybersecurity, Information Technology, Information Assurance, or a related area of study desired, with 4+ years of experience.
- Active TS/SCI security clearance.
- Concentrated experience in the CND discipline.
- Professional experience monitoring and investigating alerts from cybersecurity tools.
- Experience with Security Information and Event Management (SIEM) systems such as Splunk and Elastic.
- Experience with Network Intrusion Detection/Prevention Systems (NIDPS), such as Cisco FirePower and Palo Alto NGFW, as well as host-based tools such as Trellix ePO, Microsoft Defender, and Tanium.
- Knowledge of scripting and coding languages such as Python, Perl, Ruby, JavaScript, PowerShell, C, C++, and Java.
- Knowledge of penetration testing and red team tactics, techniques, and procedures, as well as tools such as Kali, SamuraiWTF, Nmap, Burp Suite, sqlmap, and Metasploit.
- Knowledge of ticketing systems, report writing, and intelligence gathering, analysis, and dissemination techniques specific to cybersecurity.
- Strong analytical, conceptual, and problem-solving skills.
Required Certifications
- Must possess one of the following active certifications: CompTIA Security+, CompTIA CySA+, CompTIA PenTest+, CompTIA Cloud+, CEH, FITSP-O, GIAC GMON, GIAC GRID, GIAC GCIA, GIAC GCIH, GIAC GICSP, GIAC GCED, GIAC GDSA, GIAC GSEC, CFR, or Cisco CyberOps.