System Administration - Insider Threat

Position Overview

The Cybersecurity System Administrator requires an associate's degree or certificate from a technical training institute and a minimum of five years of related technical experience in supporting an Information Technology (IT) environment. 

The Cybersecurity Specialist serving as a System Administrator within the Insider Threat (InT) team is responsible for configuring, maintaining, and operating network infrastructure that supports the InT mission. This role ensures that IT systems remain secure, stable, and optimized to protect sensitive operations.

The System Administrator will perform the following responsibilities:

• Configure and maintain systems supporting InT operations.
• Monitor networks continuously to detect suspicious activity and enhance overall cybersecurity posture.
• Monitor server application for availability, latency, and gateway queuing and maintain current knowledge of vendor upgrades and patches for both the server and client applications.
• Analyze security incidents and implement effective incident response plans.
• Manage and secure systems, user accounts, and access controls.
• Perform regular updates, patches, and backups.
• Ensure User Activity Monitoring (UAM) tools and processes adhere to Committee on National Security Systems Directive 504 (CNNSD-504).
• Monitor the server application, system, and security logs using various tools such as Microsoft Operational Management server VMWare vSphere, Qwest Auditor, and NetIQ.
• Possess knowledge of other Microsoft products used to manage an enterprise operation.
• Ability to develop project management documentation.
• Ability to work without guidance.
• Ability to manage and initiate projects.
• Other duties as assigned.

CNNSD-504 Compliance:

This directive mandates stringent safeguards to protect national security systems against insider threats: individuals with authorized access who may attempt to exploit, compromise, or disclose classified information. Compliance with CNNSD-504 is vital to early detection and mitigation of these risks.

Analyzing User Activity Data:

Identify suspicious and/or anomalous behavior patterns or policy violations. Generate reports on user activity and trends. Set up and respond to activity-based alarms. Investigate security incidents and provide evidence. Ensure compliance with data privacy regulations.
 

• Review the alerts of the tool(s) for evaluation and when necessary, furtherance to the agency InT Coordinator. 
• Report validated triggers/anomalies detected immediately to the InT Coordinator.Detect insider threats, whether intentional or unintentional, by monitoring user activity for suspicious behavior such as unauthorized access to sensitive data, classified platforms, unusual file transfers, and excessive access attempts. 
• Conduct daily all-source integration and analysis of information to establish normal baseline activities, to include indicators of anomalous activity and privileged user activity logs.
• Initiate Cyber Analysis and Response Team (CART) case procedures. Notify the Information Technology Directorate (ITD) Network Operations Security Center (NOSC) of actionable alerts and threats to the networks initiated by or attributable to users.
• Provide professional advice regarding the agency level policy detailing the use of a Focused Observation capability for the monitoring of a specific user.
• Prevent data breaches.
• Ensure compliance by providing a record of user activity and demonstrating an adherence to policies.
• Ensure data security by monitoring access and usage.<