Description
We are seeking a Cyber Security Analyst to support the C5ISR Defensive Cyber Solutions Branch (DCSB) and help protect critical Department of War networks, systems, and data from sophisticated cyber threats.
You will join a high-visibility Security Operations Center (SOC) providing 24x7x365 defensive cyber operations, including continuous monitoring, threat detection, incident response, and vulnerability management.
The team protects a diverse, multi-tenant environment spanning on-premises infrastructure and leading cloud platforms, including AWS, Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud, and SaaS environments.
Responsibilities:
- Lead and coordinate investigations throughout the Incident Response lifecycle, from initial detection through remediation.
- Correlate and analyze security events, alerts, logs, and network data to determine the scope and impact of cyber incidents.
- Acquire and analyze endpoint and network artifacts, including NetFlow and full packet capture, to identify malicious or suspicious activity.
- Identify attacker tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to strengthen detection and response capabilities.
- Tune and maintain SIEM and IDS technologies to reduce false positives and improve SOC detection effectiveness.
- Develop and maintain Incident Response processes, procedures, workflows, and playbooks.
- Document investigations and response actions in case management systems and prepare clear, actionable incident reports.
- Collaborate with cyber professionals in a fast-paced operational environment to defend the DoD Information Network (DoDIN) against sophisticated threats and advanced persistent threat (APT) actors.
Requirements:
- Bachelor's degree and 4–8 years of relevant cybersecurity experience.
- Hands-on experience using an enterprise Security Information and Event Management (SIEM) platform.
- Experience analyzing high volumes of security logs and network data, including NetFlow and/or full packet capture.
- Experience with network traffic and packet analysis.
- Strong understanding of TCP/IP, common ports and protocols, network traffic flows, the OSI model, system administration, defense-in-depth, and network security technologies.
- Understanding of cloud security concepts and considerations.
- Familiarity with Unix-based systems.
- Ability to work effectively in a collaborative, mission-focused SOC environment.
- Ability to work the 6:00 am to 2:00 p.m day shift.
- Baseline certification (Security+ CE) and CSSP-Infrastructure Support certification at start.
- U.S. citizenship with an active TS/SCI clearance with SAP Eligibility.
Pay Range: $87,100.00 - $157,450.00