Content Developer (SIEM Cyber Security)

Bristol Bay Resource Investments • San Antonio, TX

308d

About The Position

STS Systems Support, LLC. (SSS) is seeking a Content Developer (SIEM Cyber Security) at Lackland AFB in San Antonio, TX.

Requirements

• DoDD 8570.01‐M/8140.01 I AT Level III CND
• Active TS/SCI
• More than 5 years of SIEM technology such as ArcSight, Splunk, and/or ELK.
• More than 3 years with network traffic analysis, ports, and protocols.
• BA/BS or MA/MS.
• Extensive knowledge with IDS/IPS systems currently in use by the Department of Defense (DoD), Services, and Agencies.
• More than three (3) years of experience with Network Traffic Analysis; ports and protocols.
• SANS GCDA or equivalent certification(s).
• Extensive knowledge of MITRE ATT&CK framework, and its uses within the cybersecurity community.

Nice To Haves

• More than one (1) year of experience with Security, Orchestration, Automation, and Response (SOAR) platforms such as Phantom and/or Demisto.
• Proficient in Python and PowerShell.

Responsibilities

• Analyze DCO events.
• Apply current industry SIEM best‐practices.
• Use security alerts correlated with log enrichment data to enhance the operator's ability to identify real attacks.
• Establish security control effectiveness and monitor for unauthorized outbound connections.
• Create detections by analyzing log data across the enterprise.
• Develop dashboards and visualizations to identify adversarial activity.
• Use log data to establish and implement virtual tripwires for early detection.
• Analyze and ingest security logs into the SIEM in order to optimize for performance of the SIEM.
• Conduct designing, implementing, and testing of various SIEM solutions.
• Create and support the creation of SIEM Use Cases and understand what alerts and log enrichment is necessary to meet the required acceptable false positive rate.
• Create, test, and validate filters and rules.
• Build and implement event correlation rules, logic, and content in the SIEM.
• Tune SIEM event correlation rules and logic to filter out security events associated with known and well established network behavior, known false positives and/or known errors.
• Analyze malware threats to develop behavior based detections that alert and/or prevent malicious activity.
• Automate tasks in the SIEM using a common programming or scripting language.
• Create scheduled and ad‐hoc reporting with SEIM tools.
• Create and maintain SIEM documentation.
• Develop and execute a process to review and maintain SIEM resources such as rules, filters, lists, trends and reports.
• Utilize SIEM to develop metrics collection, analysis, and create reports upon request.
• Provide training to government personnel as requested.
• Provide knowledge transfer of tools, processes and procedures to government personnel as requested.
• Provide OJT to other contractor employees, military, and/or civilian personnel, and ensure continuity folders/working aids are updated at least once per quarter in order to ensure efficient transition when personnel rotate.
• Maintain currency on latest industry trends and provide operational reports/assessments for development of tactics, techniques, and procedures.
• Create, document, and report metrics for analysis to improve weapon system processes and mission execution.
• Support operational leaderships tasking as it relates to Content Development functions and responsibilities.

Benefits

• Paid holidays
• Paid time off including sick and vacation leave
• Medical, dental and vision insurance
• Flexible spending accounts
• Short and long term disability
• Company paid life insurance
• 401(k) with a company match
• Discretionary profit sharing
• Tuition reimbursement

What This Job Offers

• Industry: Management of Companies and Enterprises
• Education Level: Bachelor's degree