Responsibilities:
• Monitor SIEM and other cybersecurity platforms to identify and respond to cyber threats
• Analyze logged events and network traffic for indications of attack or compromise
• Investigate Advanced Persistent Threats and low-and-slow adversary activity
• Perform cybersecurity incident detection, analysis, containment, and response
• Conduct root-cause analysis of cybersecurity events and incidents
• Analyze security alerts across multiple defensive security technologies
• Support enterprise cybersecurity tools and applications
• Apply Defense-in-Depth principles to improve enterprise security posture
• Use threat intelligence and OSINT to improve detection and response capabilities
• Develop scripts and tools to improve threat detection and incident response
• Support implementation and sustainment of defensive signatures and perimeter security controls
• Coordinate incident findings and response actions with cybersecurity stakeholders Qualifications:
• 5+ years of relevant cybersecurity experience
• 2+ years performing root-cause analysis of cybersecurity events and incidents
• Working knowledge of at least two security technology areas such as firewalls, IDS/IPS, endpoint protection, DLP, vulnerability management, forensics, malware analysis, or device hardening
• Understanding of Defense-in-Depth
• Ability to develop scripts and tools supporting detection and incident response
• Experience with SPL, Python, and/or PowerShell preferred
• DoD Top Secret clearance
• Eligible for SCI access
• Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission
|