Responsibilities:
• Research and develop new threat-detection use cases based on emerging threats and cyber threat intelligence
• Develop SIEM detection content based on feedback from Incident Response and Threat Detection analysts
• Identify gaps in security monitoring, protection, and analytics capabilities
• Develop and maintain custom scripts to enhance SIEM functionality
• Review the quality and effectiveness of security data feeds
• Recommend and implement improvements to SIEM data ingestion and detection content
• Develop alerting priorities for critical systems and applications
• Create signatures and detection logic tailored to individual programs and applications
• Collaborate with cybersecurity tool SMEs, engineers, analysts, and mission stakeholders
• Analyze network architecture and log sources to develop appropriate detection strategies
• Map detection content and adversary behavior to MITRE ATT&CK
• Support Defense-in-Depth through improved enterprise detection capabilities Qualifications:
• 5+ years of relevant IT experience
• 3+ years working with a SIEM in a content-development or Incident Response role
• 3+ years of System Administration and/or Network Administration experience
• Understanding of various log formats
• Understanding of the MITRE ATT&CK framework
• Strong understanding of network architecture
• Experience developing and maintaining scripts, preferably using PowerShell, Python, or SPL
• Understanding of Defense-in-Depth
• Current DoD Top Secret clearance
• Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission
|