Overview:
- Tier One Technologies is looking for a Detection & Automation Engineering (DAE) / Super Intelligence (SI) Cyber Threat Analyst to work with our direct US Government client.
- This semi-remote Contract-to-Hire position can start in Falls Church, VA, Raleigh, NC or Eagan, MN.
- SELECTED CANDIDATES WITHOUT REQUIRED CLEARANCE WILL BE SUBJECT TO A FEDERAL GOVERNMENT BACKGROUND INVESTIGATION TO RECEIVE IT.
Responsibilities:
- Support CISO Operations in designing, implementing, and maintaining automated/Super Intelligence security detection, integration capabilities across enterprise security monitoring technologies.
- Improve threat detection and response through detection engineering, security automation, systems integration, data analysis, super intelligent and continuous improvement of detection content and workflows.
- Collaborate closely with security operations, threat intelligence, and incident response stakeholders, along with strong documentation and operationalization practices.
- Build automation/SI and integration workflows to improve detection and response.
- Integrate and optimize security technologies (e.g., SIEM, EDR, SOAR, threat intelligence) into a cohesive detection architecture.
- Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions.
- Execute testing, evaluation, and validation of detections and automation/SI workflows; drive continuous improvements based on results and operational feedback.
- Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.
- Create and maintain technical documentation, SOPs, and runbooks to support reliable operations.
- Work closely with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
- Research and assess new security and SI/ML capabilities to enhance detection effectiveness.
Qualifications:
- A degree from an accredited College/University in the applicable field of services is required. If an individual's degree is not in the applicable field, then 4 additional years of related experience is required.
- 8+ years of experience with cyber security operations, threat hunting, and incident response.
Essential Technical Knowledge Areas (plus important/beneficial
- SOAR Tools: SentinelOne, SentinelOne Hyperautomation, Splunk Enterprise Security, Splunk SOAR
- Super Intelligence (SI) Security
- SOC operations and processes
- Threat intelligence lifecycle and analysis
- Incident response methodologies
- Network protocols and architecture
- Operating systems (Windows/Linux/Unix)
- Cloud platforms (AWS/Azure/GCP)
- Security architecture and design
- Programming/scripting (Python, PowerShell, Bash)
- API integration and development
- Detection engineering methodologies
- Security automation and orchestration concepts
Frameworks, Standards & Compliance Expectations
• NIST SP 800-53 Security Controls
• CIS Controls
• MITRE ATT&CK Framework
Important/beneficial
• CISA NICE Framework
• ISO 27001/27002
• FISMA
• FedRAMP
• OMB Circulars and Federal Cybersecurity Directives
• Privacy Act
• Malware analysis
• Digital forensics procedures
• Risk assessment methodologies
• Machine learning and SI for security
Certifications
(One or more required): CISSP or CISA or CISM or GIAC or RHCE.
- Excellent oral and written communication skills.
- Must be able to obtain a Position of Public Trust Clearance.
- All candidates must be a US Citizen or have permanent residence status (Green Card).
- Candidate must have lived in the United States for the past 5 years.
- Cannot have more than 6 months travel outside the United States within the last 5 years. Military Service excluded.