Cyber Threat Intelligence Analyst

Overview

Visit our website at www.beringstraits.com to apply!

Bering Global Solutions, LLC (BGS) is a recognized leader in providing Technical and Program Management Services, Information Technology, and Logistics Services and Support. BGS is currently seeking a Cyber Threat Intelligence Analyst. The ideal candidate for this job will serve as a Cyber Threat Intelligence Analyst within the federal client’s Cyber Division – Cyber Integration Center. A highly motivated individual with strong technical, communication, and organizational skills will succeed on this program.

The mission of the federal client’s Cyber Threat Intelligence (CTI) program is to produce and deliver relevant, accurate, and timely curated information (cyber threat intelligence) so that the federal client can proactively implement countermeasures to better inoculate itself from potential cyber threats. The CTI Team gathers information on adversarial behaviors and tactics, including indicator of compromise (IOC) and tactics, techniques, and procedures (TTP) lists and provides this information to the client’s threat hunting team, as well as the SOC and other organizations where applicable. In addition to gathering information on current threats, the CTI team also configures and maintains a consistent ingestion of IOCs into the federal client’s SIEM for detection and analytical purposes.

 

Responsibilities

ESSENTIAL DUTIES & RESPONSIBILITIES

The Essential Duties and Responsibilities are intended to present a descriptive list of the range of duties performed for this position and are not intended to reflect all duties performed within the job. Other duties may be assigned.

• Perform research using open-source and classified Cyber Threat Intelligence sources to identify and track Advanced Persistent Threats (APT), malware packages, and exploitable vulnerabilities.  Identify and prepare profiles on any threats or topics that are applicable to the client.
• Provide the in-house Threat Hunting & Forensics (THF) Team with Indicators of Compromise (IOCs), Tactics, Techniques, and Procedures (TTPs), and other background information about threats relevant to the client.
• Assist the THF Team and the client’s Security Operations Center (SOC) in the development of new and specific detection techniques for the profiled threats.
• Notify appropriate stakeholders of items of concern, such as unpatched vulnerabilities, attack surface exposures, and other threats discovered in the research process.
• Ongoing maintenance of the Cyber Threat Intelligence SOP to revise processes and reporting methods.
• Maintain consistent awareness to industry trends and topics, including available cyber security intelligence tools, blog posts, and news postings.  This will also include monitoring of various social media platforms for any emerging threats, as well as contra-reputational information posted about the client.
• Prepare professional written deliverables and oral presentations for the client’s senior leadership on profiles, threats, metrics and trends as required.
• Adapt to dynamically changing priorities, based on severity of threats, leadership requests, or sources of information.
• Cultivate professional relationships with other organizations, internal departments, and stakeholders, exchanging information and findings as appropriate.
• Process controlled information reports from CISA as required.
• Develop a proactive method of monitoring Darknet sources for information which may indicate a threat or item of concern for the client.
• Monitor and maintain a cloud-based MISP installation, indicator ingestion, and evaluate new threat feeds for MISP.
• Evaluate any new threat intelligence tools, retail or open source, that may be of benefit to the client.
• Track work progress and metrics using Azure DevOps.
• Cross-train with related teams, including THF Team, SOC, and Penetration Testing Team

QUALIFICATIONS - EXPERIENCE, EDUCATION AND CERTIFICATION

Required (Minimum) Qualifications

• Moderate understanding of basic computer and networking technologies
• Windows operating systems
• Networking technologies (routing, switching, VLANs, subnets, firewalls)
• Common networking protocols – SSH, SMB, SMTP, FTP/SFTP, HTTP/HTTPS, DNS, etc.
• Common enterprise technologies – Active Directory, Group Policy, and the Microsoft Azure suite of services.
• Understanding of current system logging technology and retrieving information from a plethora of platforms.
• Ability to work with or learn Microsoft Power BI.
• Ability to obtain and maintain Public Trust Security Clearance.