Intrusion Detection Monitoring and Incident Management Support

About the role

The United States Transportation Command (USTRANSCOM) at Scott Air Force Base, IL, requires an Intrusion Detection Monitoring and Incident Management Support position. This role supports the USTRANSCOM CCE, which includes various operating systems and security domains.

Responsibilities

• Intrusion detection/analysis/incident management activities for all USTRANSCOM information systems/networks subscribing to USTRANSCOM CSSP services.
• Perform day-to-day mission execution of intrusion detection monitoring and incident management and response activities.
• Review audit data, e-mail spam, and network traffic data for irregularities or potential security violations.
• Correlate and analyze security data and events from alert and traffic flow systems.
• Identify potential distributed, long-term, coordinated, low-visibility network-based attacks.
• Review and share significant activity via SIGACT reports and AS&W tippers.
• Operate and maintain the intrusion detection monitoring and incident management tool suite.
• Maintain the existing configuration and integrity of the tool suite IAW applicable policies and instructions.
• Develop new intrusion detection signatures and modify existing ones as directed by the Government.
• Report false positive alerts IAW applicable USCYBERCOM/JFHQ DODIN orders.
• Develop and maintain security analysis scripts and analytic displays.
• Operate and maintain a service assurance capability for intrusion detection monitoring and incident management tools.
• Collect and provide the Government with monthly metrics on intrusion detection monitoring and incident management activity.
• Provide current documentation on intrusion detection monitoring and incident management processes and procedures.

Qualifications

• 5+ years of experience with monitoring and identifying vulnerabilities, anomalies, and active threats.
• Experience using security Information and Event management (SEIM) tools to analyze traffic data.
• Certified Network Defender (CND) certification.
• CompTIA Security+ (ce) certification.

Supervisory Responsibilities

This position does not supervise others.

Work Environment

This job operates in a professional office environment. This role routinely uses standard office equipment. Must be able to operate a computer and other standard office equipment. Must be able to remain in a stationary position, 80%.

Physical Demands

Must be able to operate a computer and other standard office equipment. Must be able to remain in a stationary position, 80%.

Travel

Minimal travel, 5 – 10%.