Job Description

Review audit data and network traffic data for irregularities or other indications of real or potential security violations

·  Understanding of Cloud architecture and security practices to include knowledge of modern threat vectors

·  Familiarity with Endpoint Detection Response tools E.G. Crowdstrike, Tanium, Signature based detection software  

·  Correlate and analyze security data and events from alert and traffic flow

· systems

· Identify potential advanced persistent and coordinated threats across

multiple platforms

·  Perform tuning and optimization tasks to include sensor rule review and

· log aggregation/visibility

·  Perform reviews of implemented cybersecurity defense IDS/IPS rules,

exceptions, and log availability and content

·  Perform reviews of aggregated log data to identify missing required

· sources; ensuring log data format IAW logging standards

·  Develop/enhance existing intrusion detection analytics, dashboards, and

signatures to remain commensurate with evolving cyber threat

·  Investigate all security related events and incidents involving assigned

information systems

·  Report identified security incidents through approved reporting process

·  Review and share significant activity reports and tippers

·  Perform incident response based on security events identified

·  Develop and deploy countermeasures in response to cybersecurity

incidents IAW Incident Response Plan

·  Analyze and identify root cause and lessons learned from security

· incidents; document formal after-action reports (AAR)

·  Provide recommendations related to tactical response actions, such as

· updating signatures and heuristics

·  Develop and maintain security analysis scripts and analytic displays

Preferred knowledge and experience with the following:

·  NIST and DoD security policies

· Cloud Security best practices

·  Securing virtualization/cloud infrastructure concepts, technologies and

· services

·  Microsoft server and workstation, Unix, and Red Hat Linux Enterprise OS

· security configurations

·  Basic forensic requirements and processes

Requirements

Secret with Top Secret eligibility

3 yrs experience

One or more approved DoD 8570 baseline certifications for:

IAT II and CSSP Analyst.

Link to approved certifications:

Job Tags

Similar Jobs