Sr. Principal Cyber Threat Analyst
Northrop Grumman · New York, NY · 1 mo ago
On-siteInformation Technology$118k–$194k/yrFull-time
We need to output HTML fragment with sections for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content.
We need to parse the posting.
First, remove boilerplate: relocation assistance, clearance required, clearance type, travel, etc. Those are metadata; we can fold into a short items? Or keep as prose? The rule: Use
maybe. But we should not create headings for them unless they have content. They are metadata but we can include in a paragraph maybe under About the role? The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it." So we can include a short paragraph with those details. We need to preserve all substantive information. Let's extract sections: - About the role: description paragraph(s) about Northrop Grumman, mission, CIDO seeking Senior Principal Cyber Threat Analyst, tasks, etc. We'll put that in
under
About the role
. - Responsibilities: list under "Key Responsibilities". The posting includes: "Analytical triage and prioritizations of concurrent cyber events, host and network based log analysis, correlation of network indicators and PCAP data, event timeline generation, and root cause analysis. The incumbent will be required to independently generate customized scripts to facilitate his/her analysis and prepare detailed written analyses of events. Additionally, they will often be required to brief their findings to both technical and non-technical senior management audiences." We can turn each sentence into- for any list of duties/requirements/benefits. So we should make a list. We'll split into items:
- Analytical triage and prioritization of concurrent cyber events
- Host and network based log analysis
- Correlation of network indicators and PCAP data
- Event timeline generation
- Root cause analysis
- Independently generate customized scripts to facilitate analysis
- Prepare detailed written analyses of events
- Brief findings to technical and non-technical senior management audiences
That seems fine.
- Requirements: The posting has "Basic Qualifications" and also "Must be able to prepare and analyze data and figures." etc. Also "Candidates must have a current U.S. Government Top Secret level security clearance, to include SCI access and a recent Polygraph [adjudicated within the last 5 years], in order to be considered." Also "Must have experience with two or more analysis tools used in a CIRT or similar investigative environment." etc. Also "Must have a minimum of 4 year of experience conducting analysis of log data in support of intrusion analysis or cybersecurity operations." Also "Must have a minimum of 4 years of experience with Python, Perl or other scripting language."
Also education: "8 Years of relevant experience with a Bachelors in Science; OR 6 Years with Masters; OR 4 Years with PhD."
We can combine these into a Requirements section (maybe as list). Also we have "Preferred Qualifications" separate; we could put under Qualifications or Skills. The instruction: Use headings for Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we need to decide what goes where.
We have Basic Qualifications (mandatory) and Preferred Qualifications (preferred). Could treat Basic Qualifications as Requirements, Preferred Qualifications as Qualifications (or Skills). Also there are technical skills like scripting languages, analysis tools, etc. Those could go under Skills.
Let's map:
- Requirements: Basic Qualifications (education+experience+clearance+experience specifics). We'll list items.
- Qualifications: Preferred Qualifications (awareness of exploits, understanding OSI, experience with large data sets, HPC, AI tools, endpoint detection, cyber threat intel methodologies, Linux/Unix and Windows proficiency, familiarity with threats, certifications). We'll list.
- Skills: maybe we could list specific technical skills like scripting languages, analysis tools, etc. But we already have some in Requirements (experience with scripting languages). Could also put under Skills: "Python, Perl or other scripting language", "analysis tools used in a CIRT", "log data analysis", etc. However to avoid duplication, we might keep Skills for things like "Linux/Unix and Windows proficiency", "shell (Bash, PowerShell) scripting", "endpoint detection and response technologies", etc. But many overlap.
Given the instruction to prefer few substantive sections over many thin ones, we could combine Requirements and Qualifications into one section? But headings are prescribed; we can still include both if they have content. We'll include Requirements and Qualifications.
- Benefits: The posting mentions: "We offer flexible work arrangements, phenomenal learning opportunities, exposure to a wide variety of projects and customers, and a very friendly team environment. Our diverse portfolio of programs means there are endless paths to cultivate your career. We also offer exceptional benefits/healthcare, and a great 401k matching program." Also later: "In addition, Northrop Grumman provides a variety of benefits including health insurance coverage, life and disability insurance, savings plan, Company paid holidays and paid time off (PTO) for vacation and/or personal business."
We can make a Benefits list.
- Pay: The posting includes "Primary Level Salary Range: $117,500.00 - $193,900.00" plus description about factors, overtime, shift differential, discretionary bonus, annual bonuses, long term incentives for VP/Director. So we have pay info. We'll include Pay section.
- Schedule: The posting mentions travel: "TRAVEL: Yes, 10% of the Time". Also maybe flexible work arrangements. But schedule specifics? Not explicit work hours. We could include schedule info under Schedule if we have something like travel percentage. The instruction: never create Pay/Schedule/Benefits sections unless the posting actually states them. Travel is mentioned, but schedule? Not explicit. However we could treat travel as part of schedule? Might be okay to include Schedule with travel % and flexible work arrangements. But we need to ensure we have real specific content. The posting says "TRAVEL: Yes, 10% of the Time". That's specific. Also "We offer flexible work arrangements". So we can include Schedule section with those points.
Now we need to output HTML fragment only, no /. Use
for section headings. Use
- for lists. Use
for prose. We also need to include minor metadata like relocation assistance, clearance required, clearance type, travel (but travel we already used in Schedule). Actually travel is metadata but we used it. Relocation assistance: "No relocation assistance available". Clearance required: Yes, clearance type SCI. We could fold those into a short paragraph under About the role or maybe a separate
before sections. The instruction: fold minor metadata into a short
or drop it. So we can add a
at start: "Relocation assistance: not available. Clearance required: Yes (SCI). Travel: 10% of time." But we already used travel in Schedule; maybe we should not duplicate. Better to include relocation and clearance in a short paragraph, and keep travel in Schedule. Let's craft:
Relocation assistance: not available. Clearance required: Yes (SCI).
Then sections. Now we need to ensure we don't include boilerplate like EEO, equal opportunity, scam warning, application instructions, etc. Remove those. Also remove lines like "The application period for the job is estimated to be 20 days..." etc. That's application instructions? It's about timeline; maybe considered boilerplate? It's not EEO but it's about application period; likely we should drop as it's application instruction. The instruction says remove application instructions. So drop that. Also drop "Northrop Grumman is an Equal Opportunity Employer..." etc. Also drop "U.S. Citizenship is required for all positions with a government clearance..." maybe that's relevant? It's a requirement; could be included under Requirements. It says U.S. Citizenship is required for all positions with a government clearance and certain other restricted positions. Since this role requires clearance, we can include that as a requirement. So we keep that. Now let's draft. Structure:Relocation assistance: not available. Clearance required: Yes (SCI).
About the role
... (the descriptive paragraphs) ...
Responsibilities
- ... ...
Requirements
- 8 years of relevant experience with a Bachelor’s in Science; OR 6 years with a Master’s; OR 4 years with a PhD.
- Current U.S. Government Top Secret level security clearance with SCI access and a recent polygraph (adjudicated within the last 5 years).
- U.S. citizenship required (due to clearance).
- Ability to prepare and analyze data and figures.
- Experience with two or more analysis tools used in a CIRT or similar investigative environment.
- Minimum 4 years of experience conducting analysis of log data in support of intrusion analysis or cybersecurity operations.
- Minimum 4 years of experience with Python, Perl, or other scripting language.
Qualifications
- Demonstrated awareness of current endpoint and network exploits.
- Familiarity with computer network exploitation methodologies and tools.
- Understanding of network communication protocols at all layers of the OSI model.
- Experience working with large data sets, high-performance computing systems, and artificial intelligence (AI) tools.
- Experience working with endpoint detection and response technologies.
- Experience with cyber threat intelligence methodologies.
- Linux/Unix and Windows proficiency, including shell (Bash, PowerShell) scripting.
- Familiarity with current information security threats facing U.S. defense contractors or the U.S. Government.
- Preferred technical certifications (or equivalent): GIAC GCED, GCIH, GCIA, GCFA, GREM, CFCE; other vendor certifications (e.g., EnCE, ACE, CCNA, CISSP, etc.) considered.
Skills
We could list specific technical skills not already covered. But we have many overlapping. Perhaps we can skip Skills section if content is thin. But we have some like "flexible work arrangements" not a skill. Maybe we can combine Skills with Qualifications? But we need to follow instruction: include a section ONLY when posting has real, specific content for it. We have not explicitly listed a "Skills" section in the posting; they mention skills in responsibilities and qualifications. Could we create a Skills section with items like "Python, Perl, or other scripting language", "analysis tools", "log data analysis", etc. But those are already in Requirements. To avoid duplication, maybe we omit Skills section. But the instruction says we can use headings for Skills; we are not required to include it if no specific content. The posting does not have a distinct "Skills" heading; but we could extract skills from the text. However to avoid thin sections, maybe we skip Skills. - Benefits: we have content.Benefits
- Flexible work arrangements
- Phenomenal learning opportunities
- Exposure to a wide variety of projects and customers
- Friendly team environment
- Exceptional benefits/healthcare
- Great 401k matching program
- Health insurance coverage
- Life and disability insurance
- Savings plan
- Company-paid holidays
- Paid time off (PTO) for vacation and/or personal business
Pay
- Primary level salary range: $117,500
- for lists. Use