Cyber Content Developer

IP Secure, LLC • San Antonio, TX

23h • Onsite

About The Position

The Cyber Content Developer/SIEM Engineer implements mission-driven use cases that give analysts a manageable SIEM view of security incidents, including workflow and reporting. The role proactively maintains associated content and use cases, considering revisions and decommissioning, and collaborates closely with DO and DM leadership to align work with squadron requirements, priorities, and future initiatives. The position is based at JBSA Lackland in San Antonio, Texas, and requires an active TS/SCI clearance.

Requirements

• Active TS/SCI clearance.
• Ability to obtain the GIAC Machine Learning Engineer (GMLE) certification within 120 days of hire, or a BS in Computer Science or an MS in Computer Science/Cyber Security.

Nice To Haves

• At least 2 years of experience with SIEM technologies such as ArcSight, Splunk, Devo, and/or ELK.
• Experience with log handling, reports, filters, and rule creation.
• Extensive knowledge of IDS/IPS systems used by the Department of Defense, Services, and Agencies, such as the Air Force, Navy, Army, DC3, and DISA.
• At least 3 years of experience with network traffic analysis, ports, and protocols; SANS GCDA or equivalent certification(s).
• Extensive knowledge of the MITRE ATT&CK framework and its use in the cybersecurity community, including open-source projects.
• At least 1 year of experience with SOAR platforms such as Phantom and/or Demisto.
• Proficiency in Python and PowerShell.

Responsibilities

• Analyze DCO events.
• Apply current industry SIEM best practices.
• Use security alerts correlated with log enrichment data to help operators identify real attacks.
• Establish security control effectiveness and monitor for unauthorized outbound connections.
• Create detections by analyzing enterprise log data.
• Develop dashboards and visualizations to identify adversarial activity.
• Use log data to establish and implement virtual tripwires for early detection.
• Analyze and ingest security logs into the SIEM to optimize SIEM performance.
• Design, implement, and test SIEM solutions.
• Create and support SIEM use cases, and determine the alerts and log enrichment needed to meet acceptable false-positive rates.
• Create, test, and validate filters and rules.
• Build and implement event correlation rules, logic, and content in the SIEM.
• Tune SIEM event correlation rules and logic to filter events associated with known network behavior, false positives, and errors.
• Analyze malware threats and develop behavior-based detections that alert on or prevent malicious activity.
• Automate SIEM tasks using a common programming or scripting language.
• Create scheduled and ad hoc reporting with SIEM tools.
• Create and maintain SIEM documentation.
• Develop and execute a process to review and maintain SIEM resources, including rules, filters, lists, trends, and reports.
• Collaborate with DO and DM leadership to ensure tasks align with squadron requirements, priorities, and future initiatives.
• Proactively review SIEM use cases and associated content for revision or decommissioning.

Benefits

• Medical insurance
• Dental insurance
• Vision insurance
• Unlimited vacation
• Sick leave
• Paid federal holidays
• Education and certification reimbursement program
• 401(k) retirement plan with safe harbor employer match after 3 months
• Prepaid legal plan available
• ID protection plan available
• Accident insurance available
• Critical illness insurance available
• Hospital indemnity insurance available

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed