Watch Operations Analyst (Senior) - Cyber & Critical Infrastructure

At phia we hire talented and passionate people who are focused on collaborative, meaningful work, providing technical and operational subject matter expertise and support services to our partners and clients.
Watch Operations Analyst (Senior) - Cyber & Critical Infrastructure Location: On-site in Arlington, VA (no remote/telework)
Are you passionate about national security and ready to play a pivotal role in defending critical cyber and physical infrastructure? We're seeking a Senior Watch Operations Analyst to join our team.  This position is part of the DHS Cybersecurity & Infrastructure Security Agency (CISA) Integrated Operations center, which coordinates situational awareness and response to vulnerabilities, threats, and incidents affecting our nation's cyber and critical infrastructure security. This work is performed on-site in Arlington, VA and will support fixed shift operations (multiple shifts available).

What You'll Do

• Maintain situational awareness of events, incidents, and reporting related to cybersecurity and critical infrastructure security.
• Assist with cyber and physical incident coordination and draft and produce various levels reporting; analysts gather information from multiple sources and varying levels of classification, to provide accurate, timely, and actionable information to our government leadership, law enforcement, federal stakeholders, and partners.
• Provide initial triage and analysis of cyber, communications and physical incidents to identify the severity of impact to critical infrastructure to determine the level of reporting or briefing required, coordinate incident operational data collection and analysis, and monitor and update status reporting on the event through completion.
• Monitor open-source/unclassified/classified reporting channels, incident/ticket management systems, subscription-based alerting services, cable and local news, social media, and other sources for threats to the nation’s critical infrastructure and global operations impacting national security.
• Understand the operation of all communications and information technology utilized to perform daily functions.
• Follow approved work instructions and standard operating procedures, advise on updates to existing procedures, and draft new procedures as tasks and functions evolve.
• Other services and support as needed or directed by the government client.
• Work in a 24x7x365 operations center, and are expected to be willing to occasionally work different hours to cover for colleagues' absences.

Education + Requirements

• Bachelor’s degree with a minimum of 5 years related technical/operational experience, with at least one (1) year of specialized operations center experience. Additional experience may be substituted in lieu of a degree.
• Must have excellent verbal and written communication skills (this position is heavily focused around communication and coordination), with broad experience in lightweight research and analysis, and a heavy focus on knowledge synthesis and management.
• Must be comfortable working in a time-sensitive, detail-orientated, fast-paced 24x7x365 operational environment; must be able to multitask, make quick decisions and utilize critical thinking skills to deal with new/unexpected situations.
• Have the ability to read technical reporting on cybersecurity and operational technology and incidents, and be able to extract important information to provide clear and concise summary reporting for a non-technical audience.

Security Clearance

• U.S. Citizenship required.
• Active Top Secret U.S. government security clearance required.
• In addition, a selected candidate must be able to meet and maintain DHS personnel vetting requirements.

Desired

• Experience in 24x7 operational environments (e.g. Network Operations Centers, Security Operations Centers, Joint Operations Centers, Fusion Centers, etc.).
• Experience in drafting and publishing situational awareness / status reporting and briefing organization leadership on recent events and current status.
• Experience with information management, coordination, and collaboration across large enterprises and  multiple communities of interest.
• Experience with Federal and/or DHS policy and organizational structure around critical infrastructure (HSPD-7, NIPP, etc.).
• Experience with workflow management systems such as Remedy and ServiceNow
• Related cybersecurity certifications (e.g. CompTIA Security+, ISC2 CISSP, etc.)

Familiarity with cybersecurity concepts such as:

• Vulnerabilities, exposure, and vulnerability management (CVE, CWE, etc.),
• Threats, threat actors, and threat intelligence (including IOCs and TTPs),
• Exploits and various types of malicious software (malware,