Advanced Cyber Analytics Lead

CACI International•St. Louis, MO

6d•$90,300 - $189,600

About The Position

The Advanced Cyber Analytics Lead heads a team responsible for developing and maintaining defensive countermeasures for the enterprise. Working in a Fusion model, the role collaborates with Focused Operations and other teams to proactively prevent successful compromises and eradicate persistent adversaries already in the enterprise. The work draws on intelligence and incident reports, regular Purple Team exercises, and ongoing validation of deployed defensive countermeasures. The lead also provides expertise and mentorship to junior team members.

Requirements

U.S. citizenship and an active TS/SCI clearance.
At least 8 years of related advanced cybersecurity analytics work experience.
A certification compliant with DoD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Analyst.
Experience with data mining or building queries in a SIEM.
Strong understanding of signature development and tuning.
Strong understanding of network protocols and analysis using protocol analyzers.
Knowledge of static file signatures, such as magic numbers, and their application to developing countermeasures for files in transit and on hosts.
Good working knowledge of regular expressions.
Excellent written and verbal communication skills.

Nice To Haves

Comfort using a hex editor.
Ability to write Python, Bash, or PowerShell scripts.
Ability to analyze use cases for detection logic and identify the corresponding capability.
Good understanding of Purple Team tactics.
Familiarity with cloud security and its application to visibility gaps, data lakes, and data mining.

Responsibilities

Lead the Advanced Cyber Analytics Team in developing and maintaining countermeasures, integrating the team into Focused Operations and other teams’ processes, and training and mentoring junior members.
Analyze trends and data patterns on NGA networks to identify and predict previously undiscovered events and incidents, and develop or tune rules, signatures, and scripts as needed.
Coordinate with Defensive Cyber Operations and Focused Operations to develop or tune rules, signatures, and scripts.
Coordinate with Cybersecurity Operations Services to investigate potential sources of compromise on enterprise systems and develop or tune rules, signatures, and scripts.
Correlate and analyze incident precursors and develop or tune rules, signatures, and scripts as needed.
Collaborate with the Cyber Data Analytics team to improve SIEM alert efficiency by evaluating valid alerts and false positives, and developing or tuning rules, signatures, and scripts.
Work with the Cyber Incident Response Team to assess ongoing incident activity, predict adversary responses and locations of compromise, and assist with triage.
Document work in the authorized ticketing system with enough detail for stakeholders to reconstruct the analysis.
Provide input to recurring meetings and briefings as required.