Advanced Cyber Analytics Lead

CACI • Saint Louis, MO

4d

About The Position

The Advanced Cyber Analytics Lead leads a team responsible for developing and maintaining defensive countermeasures for the enterprise. Working in a Fusion model, the role collaborates with Focused Operations and other teams to proactively prevent successful compromises and eradicate persistent adversaries already present in the enterprise. Work includes reviewing intelligence and incident reports, conducting regular Purple Team exercises, and continuously validating deployed defensive countermeasures.

The lead analyzes data trends and patterns on NGA networks to identify and predict previously undiscovered events and incidents, then develops or tunes rules, signatures, and scripts. The role coordinates with defensive cyber, focused operations, cybersecurity operations, cyber data analytics, and incident response teams; investigates potential sources of compromise; supports incident triage; documents analyses in the authorized ticketing system; and contributes to recurring meetings and briefings. The lead also integrates the team into operational processes and trains and mentors junior staff.

Requirements

• Must be a US citizen with an active TS/SCI clearance.
• Bachelor’s degree in Engineering, Computer Science, or a related field, and 8+ years of related advanced cyber security analytics work experience.
• Must have a certification compliant with DoD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Analyst.
• Experience with data mining or building queries in a SIEM.
• Strong understanding of signature development and tuning.
• Strong understanding of network protocols and analysis using protocol analyzers.
• Knowledge of static file signatures, such as magic numbers, and how they apply to countermeasures for files in transit and stored locally on a host.
• Good working knowledge of regular expressions.
• Excellent written and verbal communication skills.

Nice To Haves

• Comfort using a hex editor.
• Ability to write Python, Bash, or PowerShell scripts.
• Ability to analyze each use case in relation to detection logic and identify the corresponding capability.
• Good understanding of Purple Team tactics.
• Familiarity with cloud security and its application to visibility gaps, data lakes, and data mining.

Responsibilities

• Lead the Advanced Cyber Analytics Team in developing and maintaining countermeasures, integrating the team into Focused Operations and other teams’ processes, and training and mentoring junior members.
• Analyze trends and patterns in data on NGA networks to identify and predict previously undiscovered events and incidents, and develop or tune rules, signatures, and scripts.
• Coordinate with Defensive Cyber Operations and Focused Operations to develop or tune rules, signatures, and scripts.
• Coordinate with Cybersecurity Operations Services to investigate potential sources of compromise on enterprise systems and develop or tune rules, signatures, and scripts as needed.
• Correlate and analyze precursors to incidents and develop or tune rules, signatures, and scripts as needed.
• Collaborate with the Cyber Data Analytics team to improve SIEM alert efficiency by evaluating valid alerts and false positives and developing or tuning rules, signatures, and scripts.
• Work with the Cyber Incident Response Team to assess ongoing incident activity, predict adversary responses and locations of compromise, and assist with triage.
• Document work in the authorized ticketing system with enough detail for stakeholders to reconstruct the analysis.
• Provide input to recurring meetings and briefings as required.

Benefits

• Flexible time off benefit.
• Learning and development opportunities.
• Healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior