Critical Infrastructure Cyber Protection & Defense Analyst

Idaho National Laboratory • Idaho Falls, ID

6d • $95,256 - $234,366 • Onsite

About The Position

This role involves providing expert cyber-related consulting services to enhance industrial control systems (ICS) cybersecurity for critical infrastructure. The analyst will offer advice on cybersecurity designs, implementation, vulnerability identification, and mitigation techniques. Responsibilities include monitoring critical infrastructure sector networks for unauthorized activities, responding to crises, and developing advanced mitigation, preparedness, and response strategies. The position also entails leading cybersecurity efforts, fostering communication with stakeholders, conducting information collection and analysis of US critical infrastructure with a focus on control systems, managing teams in creating cybersecurity products, and preparing reports and briefings. The analyst will also conduct technical analysis projects and work to improve situational awareness across sectors by developing products for diverse customers, including federal, private, and international organizations across multiple classification levels. Other duties as assigned.

Requirements

• Bachelor of Science degree in mechanical or electrical engineering, cyber security/computer sciences, and/or business/financial management from an accredited institution.
• EX3: Education/Experience: Bachelor’s and 5 years. Master’s and 2 years. PhD and 2 years.
• EX4: Education/Experience: Bachelor’s and 9 years. Master’s and 6 years. PhD and 4 years.
• Relevant experience commensurate with level. Experience shall include designing or applying control systems cyber security solutions in critical infrastructure at the system and/or regional level.
• Obtain and maintain a Q security clearance and special access as required.
• When required, must be able to work in a secure work environment to include handling/storing/processing classified and CUI information, and adhere to physical and electronic projection standards.
• Testing Designated Position (TDP)
• Expertise in Splunk SPL, including advanced search commands, statistical functions, data models, and performance optimization
• Hands-on experience with Splunk Enterprise Security, including correlation searches, risk-based alerting (RBA), notable events, and the ES framework
• Hands-on experience with using the Splunk Monitoring Console to monitor and maintain the health of a distributed Splunk ecosystem.
• Hands-on experience with data transformation using props and transforms configurations and Splunk regular expressions
• Working knowledge of the Splunk AI Toolkit (AITK) for building and applying ML-based detections
• Experience with the Splunk App for Data Science and Deep Learning (DSDL), including custom model development and deployment
• Strong understanding of the MITRE ATT&CK framework and detection engineering methodology
• Must be a US citizen.
• Must be eligible for a DOE Q clearance (equivalent to Top Secret) and SCI access.
• Must be able to work under pressure, simultaneously addressing multiple complex tasks to meet commitments while maintaining quality of work and a professional interface.

Nice To Haves

• Professional Engineer and/or Certified Information Systems Security Professional (CISSP) certifications.
• Relevant experience to include program/project management here at INL, particularly in the cyber security realm, and familiarity with industrial control systems.
• In-depth knowledge of the US energy sector and experience working with DOE, DOD and DHS and private industry on grid security-related projects is beneficial.
• Experience with detection-as-code practices and tools (Git, CI/CD pipelines)
• Proficiency in Python for data processing and model development
• Knowledge of SOAR platforms and detection automation
• Relevant certifications (Splunk Certified Power User/Admin, Splunk Enterprise Security Certified Admin, GIAC, etc.)

Responsibilities

• Deliver professional advice, expertise, strategic insight, and other cyber-related consulting services to advance industrial control systems (ICS) cybersecurity for critical infrastructure.
• Provide advice and expertise in cybersecurity designs, implementation, vulnerability identification, and mitigation techniques and procedures that will aid industry and the Nation in securing critical infrastructure systems against current and emerging threats.
• Monitor critical infrastructure sector networks to actively remediate unauthorized activities.
• Respond to crises or urgent situations within critical infrastructure sectors to mitigate immediate and potential threats.
• Develop, research, and apply advanced mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security.
• Lead cyber security efforts and deliver capability to customers.
• Promote an open and informal communication environment with both internal and external stakeholders at all levels in order to develop mutual trust and teamwork.
• Conduct information collection and analysis of United States critical infrastructure with particular emphasis on control systems and technology-controlled processes.
• Manage teams in the creation of cyber security products.
• Create related reports and provide briefings related to these issues.
• Conduct technical analysis projects.
• Work to fill gaps in current situational awareness across sectors and develop products to address the needs of a diverse customer set spanning multiple classification levels, federal, private, and international organizations.
• Other duties as assigned.

Benefits

• Medical, Dental, Vision, and Flexible Spending Accounts
• 401(k) with a 4.2% employer contribution and up to 4.8% match (regular positions) or self-contribute access (postdoctoral positions)
• Paid time off (personal leave)
• Employee Education Program (tuition assistance for eligible positions)
• Comprehensive Relocation Package

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level