Cyber Content Developer

IP Secure, LLC • San Antonio, TX

4d • Onsite

About The Position

The Cyber Content Developer/SIEM Engineer implements use cases based on mission requirements, giving analysts a manageable SIEM view of security incidents that includes workflow and reporting. The role also proactively maintains associated content and use cases, considering revisions and decommissioning. The position collaborates closely with DO and DM leadership to align tasks with squadron requirements, priorities, and future initiatives.

Requirements

• Active TS/SCI clearance.
• Ability to obtain the GIAC Machine Learning Engineer (GMLE) certification within 120 days of hire, or hold a BS in Computer Science or an MS in Computer Science or Cyber Security.

Nice To Haves

• Two or more years of experience with SIEM technology such as ArcSight, Splunk, Devo, or ELK.
• Experience with log handling, reports, filters, and rule creation.
• Extensive knowledge of IDS/IPS systems used by the Department of Defense, services, and agencies such as the Air Force, Navy, Army, DC3, and DISA.
• Three or more years of experience with network traffic analysis, including ports and protocols; SANS GCDA or equivalent certification(s).
• Extensive knowledge of the MITRE ATT&CK framework and its uses in the cybersecurity community, including open-source projects.
• One or more years of experience with SOAR platforms such as Phantom or Demisto.
• Proficiency in Python and PowerShell.

Responsibilities

• Analyze DCO events.
• Apply current industry SIEM best practices.
• Use security alerts correlated with log enrichment data to help operators identify real attacks.
• Establish security control effectiveness and monitor for unauthorized outbound connections.
• Create detections by analyzing enterprise log data.
• Develop dashboards and visualizations to identify adversarial activity.
• Use log data to establish and implement virtual tripwires for early detection.
• Analyze and ingest security logs into the SIEM to optimize SIEM performance.
• Design, implement, and test SIEM solutions.
• Create and support SIEM use cases, identifying the alerts and log enrichment needed to meet acceptable false-positive rates.
• Create, test, and validate filters and rules.
• Build and implement SIEM event-correlation rules, logic, and content.
• Tune SIEM event-correlation rules and logic to filter events associated with known network behavior, false positives, and errors.
• Analyze malware threats and develop behavior-based detections that alert to or prevent malicious activity.
• Automate SIEM tasks using a common programming or scripting language.
• Create scheduled and ad hoc reports with SIEM tools.
• Create and maintain SIEM documentation.
• Develop and execute a process to review and maintain SIEM resources such as rules, filters, lists, trends, and reports.
• Proactively review associated use-case content for revision or decommissioning and collaborate with DO and DM leadership to align work with squadron requirements, priorities, and initiatives.

Benefits

• Medical insurance
• Dental insurance
• Vision insurance
• Unlimited vacation
• Sick leave
• Paid federal holidays
• Education and certification reimbursement program
• 401(k) retirement plan with safe harbor employer match after three months
• Prepaid legal plan available
• ID protection plan available
• Accident insurance available
• Critical illness insurance available
• Hospital indemnity insurance available

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed