Description
We are currently seeking a Cyber Network Defense Analyst 3rd Shift (9PM-5AM) to join the Compartmented Enterprise Services Office (CESO) effort. This program is establishing a modern secure web service (SWS) operation as part of a state-of-the-art, highly automated platform capable of supporting a rapidly expanding customer population.
Our team supports CESO's mission to protect networked systems and services from cyber threats as CESO migrates to a high security cloud environment, operating as a 24x7, mission-critical function providing network defense, monitoring, and incident response services.
Primary Responsibilities
- Perform computer network incident detection and response activities to detect, correlate, identify, and characterise anomalous activity indicative of threats to the CESO enterprise.
- Monitor security tools and applications for possible malicious activity, investigate associated alerts or indicators, and develop recommendations for a course of action, including mitigation strategies as required.
- Document each event and its associated analysis in a ticketing system with clear, accurate technical writing so it can be reviewed and acted on appropriately.
- Maintain regular face-to-face interaction with the customer; handle issues when they are raised by the customer with little or no supervision.
- Positively influence team performance by improving CESO processes and procedures.
- Ensure system checks are performed in a timely manner and that documentation is complete and accurate.
- Assist senior analysts and/or managers with forecasting and modelling current threats.
- Develop a strong rapport with the customer and serve as a trustworthy network defense analyst.
- Collaborate with infrastructure, storage, database, and application teams to align network defense monitoring with CESO's operational requirements as the program transitions to its secure cloud environment.
Basic Qualifications
- Bachelor's degree and 2+ years of related experience; additional experience, education, or training may be considered in lieu of degree.
- Active TS/SCI security clearance required for this position.
- DoDD 8140 IAT Level II (or Level III) certification (e.g., Security+ CE).
- Strong computing systems knowledge with Windows, Red Hat, Cloud (AWS, Azure), and particularly networking, including communication protocols and familiarity with common security elements such as IDS/IPS systems and firewalls.
- Experience with implementing application/hardware security settings using vendor and DISA best business practices.
- Candidate may be asked to obtain a CI Polygraph in the future.
Preferred Qualifications
- Prior CND experience, ideally within a large enterprise or DoD/IC program environment.
- Experience monitoring intrusion detection and computer network defense appliances, applications, and analysing associated alerts.
- Experience documenting analysis and providing response recommendations in a ticketing/case management system.
- Experience reviewing system logs manually and using automatic SIEMs tools (e.g., SPLUNK, Elastic) and performing network log analysis.
- Prior experience with DISA and DISA's support to mission partners.
- An understanding of disaster recovery and business continuity concepts as they apply to secure cloud migrations.
The position is based in San Antonio, TX and is 100% on-site. Requires a TS/SCI US Government Security Clearance to start.
The pay range for this job is $69,550.00 - $125,725.00.