Cyber Threat Detection & Response Analyst

Description

Position Summary

Our Cyber Threat Detection & Response Analyst will support the Joint Service Provider (JSP) Defensive Cyber Operations (DCO) organization with Cyber Threat Intelligence products and network security monitoring and will perform as the analyst in area of cyber threat intelligence.

Duties and Responsibilities

The essential functions include, but are not limited to the following:

• Implement the core Threat Intelligence concepts (ex. Cyber Kill Chain, MITRE ATT&CK, DoDCAR)
• Produce reporting for new or emerging threats and threat vectors
• Utilize SIEM technologies to correlate security events and logs and identify threats.
• Incorporate threat intelligence into countermeasures to detect and prevent intrusions and malware infections. 
• Identify threat actor tactics, techniques and procedures and based on indicators develops custom signatures and blocks.
• Understand and employ the MITRE ATT&CK Matrix.
• Recognize what you’ll need to know to prevent or identify APT intrusions
• Identify network architectures and select network components 
• Understand concepts of log and packet analysis
• Navigate the command line using specific expressions to manipulate data
• Handle and organize disparate data about detections, attacks, and attackers
• Discovery techniques and vetting of new intelligence
• Create of Situational Awareness Reports and Threat Briefs
• Participate in incident response activities including investigation, containment, eradication, and recovery
• Document and escalate incidents according to standard operating procedures and coordinate with internal and external stakeholders as needed

Requirements

  Minimum Requirements

• Bachelor’s degree in an IT related field or equivalent years of IT related experience 
• Active and current Top Secret federal security clearance
• 10+ years of cyber-related experience with demonstrated experience in threat detection.
• Must meet DoD 8570/ 8140 IAT Level III certification requirements (e.g., CASP+, CISSP, or CySA)