Cyber Security Operations Incident Responder/Swing- Shift Lead Analyst

Responsibilities

• Collect and analyze network and/or host artifacts from a variety of sources to include logs, system images and packet captures to characterize activity, determine root cause, operational impact, and to enable rapid remediation and/or mitigation of cyber threats within the Enterprise Network through the investigation process.
• Perform cyber incident triage; to include determining scope, urgency, and potential impact; identifying the specific vulnerability; and making recommendations that enable expeditious remediation.
• Maintain an average of at least two new detection use cases per month during each year of contract execution.
• Track and validate refinement requests and provide metrics for these activities monthly.
• Utilize the MITRE ATT&CK matrix and other threat frameworks to develop detection use cases.
• Continually refine these processes with the goal of automating their execution.
• Provide subject matter expertise in creation, editing, and management of signatures, rules and filters for specialized network defense systems including but not limited to network and ESS IDS, IPS, firewall, web application firewall, proxy and SIEM systems.
• Perform duties as the alternate of the D&R technical lead when needed and effectively disseminate taskings among the team under the guidance of the technical lead.

Qualifications

• BS 5-7 Years, MS 3-5, PhD 0-2 Experience with cyber security architecture principles that achieve cybersecurity framework goals
• Minimum of a Top-Secret Clearance with SCI eligibility
• DOD 8570 IAT II and CSSP Analyst Certifications (DoD 8140)