CSOC Tier 3 Cyber Engineer

US Citizenship Required. Active Top Secret/SCI clearance with ability to obtain Top Secret SCI + Polygraph. Must obtain, within six months of start, a certification compliant with DoDD 8140.01 and DoD 8570.01-M IAT Level II and CSSP Incident Responder.

About the role

Candidate will provide Expert Cyber Security Operations Center (CSOC) Tier 3 services, including 24x7x365 coordination, execution, and implementation of containment, eradication, and recovery measures for cyber security events and incidents. Responsibilities include malware and implant analysis, forensic artifact handling and analysis, and digital media analysis on host, server, and network data.

Responsibilities

• Coordinate and implement tasks, perform analysis, and document response activities during cyber security incident response, including containment measures, IP/domain blocks, and disabling user accounts.
• Collaborate with Security and Installations Directorate (SI) Office of Counterintelligence (SIC), Insider Threat Office (SIII), and other law enforcement/counterintelligence personnel for advanced incident investigation and triage.
• Produce and coordinate security incident reports with appropriate authorities.
• Categorize incidents and events; ensure proper reporting, containment, and eradication through coordination with other contracts and organizations.
• De-conflict blue/red team activity with open incidents/events.
• Perform digital media analysis on host, server, and network data, including volatile/non-volatile memory and system artifact collection and analysis.
• Develop and identify indicators of compromise for Cybersecurity stakeholders and other contract services.
• Perform malware analysis and signature development.
• Coordinate with CSOC Tier 1 and 2 services to remediate discrepancies and provide prevention recommendations.
• Provide input and coordinate with stakeholders to develop daily CSOC Significant Activity Reports, Operations Updates, and Weekly Status Reports.
• Serve as a C-IRT member under direct Government control, developing and executing Defensive Cyberspace Operations-Internal Defensive Measures when authorized.
• Execute custom scripts, tools, and capabilities for data collection and incident response when authorized.
• Develop and document incident investigation reports, including adversary/friendly forces activity, timelines, corrective actions, and TTP recommendations within 30 days of C-IRT stand-down.
• Conduct Quality Control reviews of closed CSOC Tier 2 tickets weekly to ensure proper analysis, categorization, documentation, and notification.

Requirements

• Bachelor’s degree and 8+ years of experience in Cyber Security (CSOC).
• Active Top Secret/SCI clearance with ability to obtain Top Secret SCI + Polygraph.
• DoDD 8140.01 and DoD 8570.01-M IAT Level II and CSSP Incident Responder certification (or ability to obtain within six months).
• Skills in Cyber Defense, Malware Analysis, Network Analysis, and Security Incident Response.

Preferred Qualifications

• Master’s degree.
• IAT III certification.

Pay

The likely salary range for this position is $147,292 – $199,278. Salary will be set based on experience, geographic location, and contractual requirements.

Schedule

• Scheduled Weekly Hours: 40
• Work Location: Onsite – USA VA Springfield

Benefits

• Medical, dental, and vision plan options, some with Health Savings Accounts.
• 401(k) plan with pre- and post-tax contribution options and company match.
• Paid time off, including vacation, sick, personal time, holidays, parental leave, military leave, bereavement, and jury duty.
• Short- and long-term disability, life, accidental death and dismemberment, personal accident, critical illness, and business travel accident insurance.
• Flexible work weeks where possible to encourage work/life balance.