Cloud Threat Analyst

ASRC Federal•Hanover, MD

1d•$115,000 - $134,745•Hybrid

About The Position

ASRC Federal is hiring a Cloud Threat Analyst to support its Defense Counterintelligence Security Agency (DCSA) program based in Hanover, Maryland. The role safeguards national security systems through proactive threat hunting and advanced threat detection. The analyst monitors threat intelligence and searches network infrastructure, endpoints, cloud environments, and systems for malicious activity that may evade traditional security solutions. The position develops detection techniques, analyzes datasets for suspicious patterns and anomalies, and maps adversary tactics to the MITRE ATT&CK framework. The analyst also collaborates with CSOC team members and stakeholders on incident response and investigations, performs forensic analysis, and reports findings to senior management. The position offers remote flexibility, with a requirement to work onsite in Hanover up to one day per week. Team members may be required to report to Fort Meade daily if needed. The offered salary range is $115,000 to $134,745, depending on experience and other permitted factors.

Requirements

At least 2 years of system-level cybersecurity experience in cyber security analysis, incident response, threat hunting as part of a mid-to-large enterprise red team or threat hunt team, or enterprise vulnerability management, endpoint security, or web security within a mid-to-large enterprise.
Active Top Secret clearance and eligibility for TS/SCI.
Bachelor's degree in Information Security or a related field, or an equivalent combination of experience.
At least one certification meeting DoD 8140/8570.01-M IAM II or IAT Level II requirements. Examples include CCNA Security, CySA+, GICSP, Security+ CE, CND, SSCP, CAP, CASP+ CE, CISM, CISSP or Associate, GSLC, CCISO, HCISPP, CEH, Pentest+, OSCP, and CSSP-IR.
Ability to read, decipher, and understand system, network, or cloud logs.
Knowledge of basic enterprise and network operations.
Knowledge of the NIST Cybersecurity Framework and/or ISO 27001, particularly incident response procedures covering containment, eradication, and recovery.
Basic understanding of the MITRE ATT&CK framework.
Excellent written and verbal communication skills to articulate technical findings and collaborate with diverse teams.

Nice To Haves

Experience conducting proactive threat hunting and detection.
Experience monitoring threat intelligence sources and analyzing emerging threats, vulnerabilities, and attack vectors.
Experience searching network infrastructure, endpoints, cloud environments, and systems for malicious activity.
Experience developing threat detection techniques and strategies.
Experience using SIEM platforms and security analytics tools to analyze large datasets.
Experience tuning detection logic and alerting to improve threat detection fidelity.
Experience mapping adversary activity to MITRE ATT&CK and developing threat models.
Knowledge of advanced persistent threats and adversary tactics, techniques, and procedures.
Experience correlating threat intelligence with internal security events.
Experience conducting forensic analysis, root cause analysis, and incident impact assessments.
Experience coordinating incident response actions across SOC, engineering, system owner, and government stakeholders.
Experience developing threat hunting playbooks and maintaining technical documentation.
Experience with security documentation, evidence collection, audit response, and validation of security configurations.

Responsibilities

Conduct proactive threat hunting to detect threats that evade traditional security solutions.
Monitor and analyze threat intelligence sources for emerging threats, vulnerabilities, and attack vectors.
Search network infrastructure, endpoints, cloud environments, and systems for signs of malicious activity.
Develop and implement threat detection techniques and strategies.
Analyze large datasets using SIEM platforms and security analytics tools to identify suspicious patterns and anomalies.
Tune detection logic and alerts to reduce false positives and improve detection fidelity.
Map adversary activity to the MITRE ATT&CK framework and develop threat models.
Analyze advanced persistent threats and adversary tactics, techniques, and procedures.
Correlate threat intelligence with internal security events to identify potential compromises.
Recommend defensive improvements based on threat actor behavior and attack patterns.
Collaborate with CSOC team members and stakeholders to respond to and investigate security incidents.
Perform forensic analysis, root cause analysis, and impact assessments for security incidents.
Support incident containment, eradication, and recovery efforts.
Coordinate response actions with SOC analysts, engineering teams, system owners, and government stakeholders.
Document incidents, response actions, and remediation recommendations in accordance with government reporting requirements.
Provide reports and briefings on threat hunting activities and findings to senior management.
Develop and maintain threat hunting playbooks, processes, and procedures.
Document lessons learned and contribute to continuous improvement of security operations.
Create and maintain technical documentation for detection rules, hunting queries, and analytical methods.
Participate in improving security monitoring and incident response tools and processes.
Assist with security documentation, evidence collection, and audit response.
Validate security configurations against established baselines and policies.
Stay current with cybersecurity trends, threat actor tactics, techniques, and procedures, and defensive technologies.