Cyber Monitoring Signature Analyst

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face.

This role supports the Department of State (DoS) Diplomatic Security Cyber Mission (DSCM) program, providing technical, engineering, data analytics, cyber security, management, operational, logistical, and administrative support for the Bureau of Diplomatic Security, Cyber and Technology Security Directorate across three key offices: Cyber Monitoring and Operations, Cyber Threat and Investigations, and Technology Innovation and Engineering State.

About the role

Peraton is seeking a Cyber Monitoring Signature Analyst to work under senior detection engineers and Subject Matter Experts, utilizing cutting-edge cyber monitoring tools to build and enhance the organization's threat detection and response capabilities. This position is part of the Cyber Incident Response Team and involves collaboration with senior detection engineers, threat analysts, and incident responders to protect a global IT infrastructure against advanced threat actors.

Responsibilities

• Author, tune, and maintain correlation searches, Risk Notables, and Adaptive Response actions within Splunk Cloud Enterprise Security.
• Evaluate new analytical detections from open-source libraries and incorporate vetted alerting into a SIEM.
• Author new correlational searches in SPL/SPL2 using best practice search methodologies.
• Maintain a living MITRE ATT&CK coverage matrix; identify gaps and prioritize with SME.
• Ensure proper cohesion and health of SIEM alerting.
• Collaborate and assist system engineers with the development, configuration, and tuning of cyber security tools.
• Operationalize threat intelligence to ensure Indicators of Compromise are actionable in detections.
• Provide reporting on detection development metrics (coverage, MTTx, FP rate, notable volume by rule).

Requirements

• Bachelor's degree and 5 years of relevant experience; or, 3 years with a Master's degree. An additional 4 years of experience in lieu of the bachelor's degree will be considered.
• Must possess and maintain one of the following certifications or the ability to obtain before start date: CASP+ CE, CCNA Cyber Ops, CCNA-Security, CCNP Security, CEH, CFR, CHFI, CISA, CISSP (or Associate), CySA+, GCED, GCFA, GCIH, SCYBER, or Security+.
• Hands-on experience authoring and tuning SPL in a production Splunk environment (minimum 3 years).
• Working knowledge of Splunk Enterprise Security (correlation searches, notable events, Incident Review, Adaptive Response) – ES 8.x experience strongly preferred.
• Demonstrated experience with the Splunk Common Information Model (CIM) and writing performant searches against accelerated data models.
• Experience modifying Splunk ES searches, macros, and lookup tables.
• Familiarity with the MITRE ATT&CK framework and its application to detection engineering.
• Working knowledge of Zeek, Suricata, and at least one EDR.
• Demonstrated knowledge of the Incident Response Lifecycle and how it applies to cloud, legacy, and hybrid environments.
• Strong organizational skills.
• Proven ability to operate in a time-sensitive environment.
• Proven ability to effectively communicate orally and in writing.
• U.S. Citizenship is required.
• Ability to obtain an interim Secret clearance before start date.
• Able to obtain a Top Secret security clearance.

Preferred Qualifications

• Prior experience operationalizing Splunk ES Content Updates (ESCU) analytic stories and Risk-Based Alerting (RBA) workflows.
• Experience with Splunk Mission Control for triage, investigation, and response workflows.
• Understanding of CVEs, zero-day threats, their modes of operation, and threat detection measures.
• Working knowledge of Python and search syntax like Regex.
• Knowledge of network architecture, design, and security.
• Knowledge of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to find those system files.
• Understanding of policies and procedures to investigate incidents in a computer network.
• Knowledge of the intersection of on-prem and cloud-based technologies.
• Exposure to leading vendor cloud environments (Microsoft Azure/AAD, Google GCP, Amazon AWS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).
• Experience with EDR telemetry analysis (Microsoft Defender for Endpoint / Advanced Hunting) and/or web proxy data (Zscaler, Cloudflare).
• Experience with threat intelligence platforms and IOC operationalization.
• Experience in developing and delivering comprehensive training programs.
• Previous Incident Response experience at the analyst level.
• Knowledge and familiarity with Detection as Code.
• Knowledge and familiarity with implementation of AI-driven workflows.

Schedule

Monday - Friday, 08:00 - 16:00 (8:00 AM - 4:00 PM)

Pay

Target salary range: $80,000 - $128,000. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

Benefits

Peraton offers eligible employees a variety of benefits including:

• Medical, dental, and vision insurance
• Life insurance
• Health savings account
• Short/long term disability
• Employee Assistance Program (EAP)
• Parental leave
• 401(k) retirement plan
• Paid time off (PTO) for vacation
• Company paid holidays

A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.