Advanced Cyber Analytics Lead

CACI • St. Louis, MO

6d • $90,300 - $189,600

About The Position

The Advanced Cyber Analytics Lead leads a team responsible for developing and maintaining defensive countermeasures across the enterprise. Working within a Fusion model, the lead collaborates with Focused Operations and other teams to proactively prevent successful compromises and eradicate persistent adversaries. The work includes reviewing intelligence and incident reports, conducting regular Purple Team exercises, and continuously validating deployed defensive countermeasures.

The role analyzes data from NGA networks to identify and predict previously undiscovered events and incidents, and develops or tunes rules, signatures, and scripts. The lead coordinates with defensive cyber and cybersecurity operations teams, supports incident investigation and response, collaborates to improve SIEM alert efficiency, documents analysis in the authorized ticketing system, and contributes to recurring meetings and briefings.

This is a full-time, regular position requiring an active TS/SCI clearance and U.S. citizenship. Travel may be required up to 10%, locally. The proposed salary range is $90,300–$189,600.

Requirements

• U.S. citizenship and an active TS/SCI clearance.
• Bachelor’s degree in Engineering, Computer Science, or a related field, and 8 or more years of related advanced cybersecurity analytics work experience.
• A certification compliant with DoD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Analyst requirements.
• Experience with data mining or building queries in a SIEM.
• Strong understanding of signature development and tuning.
• Strong understanding of network protocols and analysis using protocol analyzers.
• Knowledge of static file signatures (such as magic numbers) and their application to developing countermeasures for files in transit and files residing locally on a host.
• Good working knowledge of regular expressions.
• Excellent written and verbal communication skills.

Nice To Haves

• Comfort using a hex editor.
• Ability to write Python, Bash, or PowerShell scripts.
• Ability to analyze use cases in relation to detection logic and identify the corresponding capability.
• Good understanding of Purple Team tactics.
• Familiarity with cloud security and its relationship to visibility gaps, data lakes, and data mining.

Responsibilities

• Lead the Advanced Cyber Analytics Team in developing and maintaining countermeasures, integrating the team into Focused Operations and other teams’ processes, and training and mentoring junior members.
• Analyze trends and patterns in data on NGA networks to identify and predict previously undiscovered events and incidents, and develop or tune rules, signatures, and scripts as needed.
• Coordinate with Defensive Cyber Operations and Focused Operations to develop or tune rules, signatures, and scripts.
• Coordinate with Cybersecurity Operations Services to investigate potential sources of compromise on enterprise systems and develop or tune rules, signatures, and scripts as needed.
• Correlate and analyze incident precursors and develop or tune rules, signatures, and scripts as needed.
• Collaborate with the Cyber Data Analytics team to improve SIEM alert efficiency by evaluating valid alerts and false positives, and developing or tuning rules, signatures, and scripts as needed.
• Work with the Cyber Incident Response Team to assess ongoing incident activity, predict adversary responses and locations of compromise, and assist with triage.
• Document work in the authorized ticketing system with enough detail for stakeholders to reconstruct the analysis.
• Provide input to recurring meetings and briefings as required.

Benefits

• Flexible time off benefit.
• Learning resources and learning and development opportunities.
• Healthcare benefits.
• Wellness benefits.
• Financial and retirement benefits.
• Family support benefits.
• Continuing education benefits.
• Time off benefits.
• Competitive compensation and benefits options designed to support and protect employees and their families.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior