Advanced Cybersecurity Analytics Engineer III

CACI•Saint Louis, MO

About The Position

Reporting to the Lead of Focused Operations, under the Branch Chief of Defensive Cyber Operations, the Advanced Cybersecurity Analytics Engineer III develops and maintains defensive countermeasures for the enterprise. Working within a Fusion model, the role collaborates with other Focused Operations teams to proactively prevent successful compromises and eradicate persistent adversaries already in the enterprise. Work includes reviewing intelligence and incident reports, conducting regular Purple Team exercises, and continuously validating deployed defensive countermeasures.

Requirements

Must be a U.S. citizen with an active TS/SCI clearance.
At least 8 years of related advanced cybersecurity analytics work experience.
Must hold a certification compliant with DoD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Analyst.
Experience with data mining or building queries in a SIEM.
Strong understanding of signature development and tuning.
Strong understanding of network protocols and analysis using protocol analyzers.
Knowledge of static file signatures, such as magic numbers, and their application to developing countermeasures for files in transit and stored locally on a host.
Good working knowledge of regular expressions.

Nice To Haves

Comfort using a hex editor.
Ability to write Python, Bash, or PowerShell scripts.
Ability to analyze use cases in relation to detection logic and identify the corresponding capability.
Good understanding of Purple Team tactics.
Familiarity with security in a cloud environment and its application to visibility gaps, data lakes, and data mining.

Responsibilities

Analyze trends and patterns in data on NGA networks to identify and predict previously undiscovered events and incidents, and develop or tune rules, signatures, or scripts as needed.
Coordinate with Defensive Cyber Operations and Focused Operations to develop or tune rules, signatures, or scripts.
Coordinate with other Cybersecurity Operations Services to investigate potential sources of compromise on enterprise systems and develop or tune rules, signatures, or scripts as needed.
Correlate and analyze incident precursors, developing or tuning rules, signatures, or scripts as needed.
Collaborate with the Cyber Data Analytics team to improve SIEM alert efficiency by evaluating valid alerts and false positives, and develop or tune rules, signatures, or scripts as needed.
Work with the Cyber Incident Response Team to assess ongoing incident activity and predict adversary responses and locations of compromise to assist with triage.
Document work in the authorized ticketing system with sufficient detail for stakeholders to reconstruct the analysis.
Provide input to recurring meetings and briefings as required.