Sr. Principal Cyber Threat Analyst

About the role

The Senior Principal Cyber Threat Analyst supports the CISO & Global Cybersecurity organization's Intelligence and Response (I&R) team. This role involves providing counterintelligence (CI) and cyber threat protection to Northrop Grumman's intellectual property, networks, and sensitive data against a variety of highly skilled adversaries.

Responsibilities

• Analytical triage and prioritizations of concurrent cyber events
• Host and network based log analysis
• CORRELATION of network indicators and PCAP data
• Event timeline generation
• Root cause analysis
• Independently generate customized scripts to facilitate analysis
• Prepare detailed written analyses of events
• Brief findings to both technical and non-technical senior management audiences

Requirements

• 8 Years of relevant experience with a Bachelors in Science; OR 6 Years with Masters; OR 4 Years with PhD
• A current U.S. Government Top Secret level security clearance, to include SCI access and a recent Polygraph [adjudicated within the last 5 years]
• Experience with two or more analysis tools used in a CIRT or similar investigative environment
• Experience conducting analysis of log data in support of intrusion analysis or cybersecurity operations
• Experience with Python, Perl or other scripting language

Preferred Qualifications

• Demonstrated awareness of current endpoint and network exploits
• Familiarity with computer network exploitation methodologies and tools
• Understanding of network communication protocols at all layers of the OSI model
• Experience working with large data sets, high-performance computing systems, and artificial intelligence (AI) tools
• Experience working with endpoint detection and response technologies
• Experience with cyber threat intelligence methodologies
• Linux/Unix and Windows proficiency, including shell (Bash, PowerShell) scripting
• Familiarity with current information security threats facing U.S. defense contractors or the U.S. Government
• One or more of the following technical certifications (or equivalent) is preferred (GIAC Certified Enterprise Defender (GCED), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Forensic Analyst (GCFA), GIAC Reverse Engineering Malware (GREM), Certified Forensic Computer Examiner (CFCE))