Cyber Threat Analyst

Type of Requisition:

Pipeline

Clearance Level Must Currently Possess:

None

Clearance Level Must Be Able to Obtain:

None

Public Trust/Other Required:

MBI (T2)

Job Family:

Cyber and IT Risk Management

Job Qualifications:

Skills:

Cyber Defense, Security Information and Event Management (SIEM), Security Operations

Certifications:

None

Experience:

7 + years of related experience

US Citizenship Required:

No

Job Description:

Seize your opportunity to make a personal impact as a Cyber Threat Analyst supporting the United States Postal Service. GDIT is your place to make meaningful contributions to challenging projects and grow a rewarding career.

At GDIT, people are our differentiators. As a Cyber Threat Analyst, you will help ensure today is safe and tomorrow is smarter. Our work depends on a Cyber Threat Analyst joining our team to analyze design, develop, implement, and support code for our government customer, the United States Postal Service.

   

HOW A CYBER THREAT ANALYST WILL MAKE AN IMPACT

In this role, a typical day will include:

• Responsible for performing triage on all security escalations and detections to determine scope, severity, and root cause.
• Monitor cyber security events, detecting incidents, and investigating incidents.
• Identify, recommend strategies, develop, and implement automation use cases leveraging AI/ML capabilities.
• Support deploying, configuring, testing, and maintaining Security Orchestration, Automation, and Response (SOAR) platform, and tools integrated with AI/ML capabilities to enhance threat detection, analysis and response.
• Provide support to contract Program Manager, as necessary.
• Effectively communicates technical information to non-technical audiences.
• Influence others to comply with policies and conform to standards and best practices.
• Investigates and analyzes potential online threats to an organization's computer systems and networks.  Monitor for malicious activity, assess vulnerabilities, and develop strategies to mitigate risks. Essentially, they act as a proactive defense mechanism against cyberattacks.

WHAT YOU’LL NEED TO SUCCEED:

Education:

• Bachelor's or Master's degree in Computer Science, Information Systems, Cybersecurity or other related fields. Or equivalent work experience.
• NOTE: If resources do not have a relevant college degree, an additional 4 years of relevant work experience is required.

Required Experience:

• 7+ years of experience with security operations, threat hunting, and incident response
• Experience in analyzing alerts from Cloud, SIEM, EDR, and XDR tools, and alerts tuning process with preference on SentinelOne, Armis, and Splunk.
• Experience in configuring network devices and analyzing network traffic
• Experience with Artificial Intelligence and Machine Learning (AI/ML) based security tools.
• Experience in researching, developing, and implementing SOAR use cases.
• Familiar with Security Orchestration, Automation, and Response (SOAR) platform
• Familiarity with cybersecurity operation center functions.
• Experience configuring and re-configuring security tools, including SentinelOne and Splunk.
• Experience implementing Security frameworks, such as MITRE ATT&CK and NIST, and can interpret use cases into actionable monitoring solutions.
• Develop, test and Implement dynamic Risk-Based Alerting (RBA)
• Identifying and developing RBA and identifying use cases for SOAR and AI/ML.
• Monitor and analyze alerts from various sources such as IDS/IPS, Splunk, Tanium, MS Defender, SentinelOne and Cloud security tools leveraging SOAR and AI/ML capabilities, and provide recommendation for further tuning of these alerts when necessary.
• Analyze network traffic utilizing available tools and provide recommendations
• Perform vulnerability assessments of recently discovered CVEs against USPS systems and network.
• Assist in the process of configuring or re-configuring the security tools.
• Perform analysis on hosts running on a variety of platforms and operating systems, to include, but not limited to, Microsoft Windows, UNIX, Linux, as well as embedded systems and mainframes.
• Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the network environment or enclave.
• Test, evaluate, and verify har