Description
We are seeking an Insider Threat/UAM (User Activity Monitoring) Analyst to join our team at the Mark Center in Alexandria, VA. The successful candidate will serve as a member of the DISA J-6 User Activity Monitoring (UAM) Team.
The UAM team plays a critical role in identifying and mitigating insider threats by analysing user activity, deploying countermeasures, and providing recommendations to improve the UAM program.
Primary Responsibilities:
- Triage and analyse UAM alerts to identify potential insider threats
- Document and report findings to impacted organisations
- Provide information to the UAM lead for customer trending and reporting
- Create and implement countermeasures to specific weaknesses against known adversarial tactics, techniques, and procedures (TTPs)
- Support meetings where UAM representation is needed
- Provide recommendations to contractor and government leadership on ways to improve the UAM program
Basic Qualifications:
- Active Top Secret/SCI clearance
- Bachelor's degree and 4+ years of professional experience; additional related years of experience accepted in lieu of a degree
- At least 1 year of incident response experience
- At least 1 year of UAM or insider threat detection experience
- Demonstrated experience with UAM capabilities and common insider threat TTPs
- Demonstrated knowledge of network traffic and communications, including known ports and services
- Demonstrated experience in coordinating with external organisations, especially Law Enforcement and Counter Intelligence
- Knowledge of incident handling procedures
Preferred Qualifications:
- Understanding of core current cybersecurity technologies as well as emerging capabilities
- Demonstrated understanding of the life cycle of cybersecurity threats (internal and external), attacks, attack vectors, and methods of exploitation with an understanding of intrusion set tactics, techniques, and procedures (TTPs)
- Knowledge of computer security principles and DoD security protocols
- Motivated self-starter with strong written and verbal communication skills, and the ability to create complex technical reports on analytic findings
- Demonstrated experience with the Windows operating system and other operating systems (e.g., Linux or Unix)
- Familiarity or experience in Intelligence Driven Defense, Cyber Kill Chain methodology, and/or MITRE ATT&CK framework
- Certifications that satisfy DoD-8570 IAT Level II
Pay Range: $87,100.00 - $157,450.00