CSSP Analysis, SME

Federal IT Consulting (FEDITC)•Indianapolis, IN

21h•Onsite

About The Position

FEDITC, LLC is seeking a CSSP Analysis, SME to lead 24/7 cybersecurity analysis, threat monitoring, and incident response operations for the DFAS Cybersecurity Service Provider (CSSP) program. The role provides subject matter expertise in security event correlation, threat intelligence, and incident handling across DFAS Common Computing Environment (CCE) enclaves, including unclassified and classified networks. On-site presence is required at a designated location. Candidates must be United States citizens and have an active Top Secret/SCI DoD security clearance. A BA/BS degree is required. The role also requires applicable defensive analyst and computing environment certifications, and the employee must obtain and maintain mandatory DoD 8140 certifications and any required clearance levels.

Requirements

Minimum 10 years of cybersecurity analysis experience in DoD or Federal environments, with increasing responsibility.
Expert-level knowledge of security event analysis, threat correlation, and incident response methodologies.
Demonstrated expertise with enterprise SIEM platforms, including Splunk, ArcSight, and Microsoft Sentinel.
Experience handling cyber incidents according to NIST 800-61 and DoD incident reporting requirements.
Strong knowledge of threat intelligence, malware analysis, and forensic investigation techniques.
Experience with vulnerability management programs such as ACAS and Nessus, and with penetration testing.
In-depth understanding of NIST 800-53, DISA STIGs, and DoD cybersecurity frameworks.
Knowledge of DoD CSSP requirements, evaluations, and JFHQ-DODIN reporting.
Proven ability to lead security analysis teams in high-pressure 24/7 operational environments.
Ability to support COOP exercises and emergency operations.
BA/BS degree.
United States citizenship and an active Top Secret/SCI DoD security clearance; candidates must also pass a background check.
Cyber Defensive Analyst (Advanced) Playlist and CySA+ certification, or equivalent per 511 A.
Computing Environment (CE) certification for privileged access roles.
Must obtain and maintain all mandatory DoD 8140 certifications and applicable security clearances.

Nice To Haves

GIAC certifications such as GCIA, GCIH, GCFA, or GNFA.
SANS DFIR certifications or equivalent.
Experience with classified network (JWICS) security operations.
Splunk Certified Security Analyst or equivalent.
Experience leading threat hunting programs.
DFAS or DoD financial system security operations experience.

Responsibilities

Lead and supervise CSSP Analysis staff delivering 24/7 security event monitoring, analysis, and incident response.
Direct real-time security event correlation, threat detection, and analysis using SIEM platforms, including Splunk, ArcSight, and Microsoft Sentinel.
Manage cybersecurity incident response, including detection, containment, eradication, and recovery operations.
Oversee threat intelligence integration, indicator of compromise (IOC) analysis, and threat hunting activities.
Coordinate internal and external incident reporting according to JFHQ-DODIN, Cyber Command, and DFAS requirements.
Lead audit support, security assessments, and compliance validation activities.
Direct vulnerability analysis, penetration testing coordination, and remediation tracking.
Develop and maintain incident response plans, playbooks, and analysis procedures.
Support CSSP program operations, including accreditation documentation and scoring metric compliance.
Coordinate with DFAS ISSM, security teams, and external stakeholders on security incidents and findings.
Ensure 100% compliance with DoD CSSP Evaluators Scoring Metrics and reporting requirements.
Support COOP exercises and emergency operations.
Maintain applicable security clearances at the level required by the client and/or applicable certifications as requested by FEDITC or required by its clients, customers, or prime contractors.