Cyber Countermeasure Specialist (TN22)

The Newberry Group•Cross Hill, SC

1d•$115,000 - $150,000•Onsite

About The Position

Newberry Group is hiring an experienced Cyber Countermeasure Specialist to support the customer’s Network Assurance and Defensive Cyber Operations team for DISA Pacific at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The work is performed under the GSM-O II Task Order 22 Boundary Cyber Defense and Cybersecurity Services Provider contract and supports defense of DODIN/DISN, USPACOM, and mission partner networks against advanced persistent threats and nation-state cyber actors. This is a full-time onsite position; telework is not permitted. Travel is required approximately 10% of the time. Relocation expenses may be eligible for reimbursement up to $10,000, and the position may be eligible for a $10,000 sign-on bonus subject to a 12-month commitment. Salary is $115,000–$150,000 annually, depending on experience and position level. The specialist engineers, tests, validates, deploys, de-conflicts, and tracks custom detection signatures, firewall rules, automated blocking mechanisms, and mitigation actions across global boundary sensors, cloud access points, enterprise SIEM platforms, and specialized networks, including environments up to Top Secret/SCI. Work includes enterprise perimeter defense, multi-cloud and Zero Trust mitigation, CSSP signature and rule lifecycle management, analysis of automated-blocking telemetry, and development of countermeasures informed by threat intelligence. The role also supports PACOM Mission Network and Joint Operational Edge coalition environments, defensive automation and SOAR playbooks, and operations within SCIFs at Ford Island. The role requires an active DoD Top Secret clearance with SCI eligibility; Secret clearance may be acceptable with Government approval. Candidates must meet the stated education and experience requirements for Level II or Level III, hold an accepted DoD 8140.03/DCWF Work Role Code 521 baseline certification or qualifying degree before starting, and be able to obtain a Computing Environment certification within six months. Participation in an on-call rotation for emergency after-hours or high-priority containment events is required.

Requirements

Active DoD Top Secret clearance with SCI eligibility; Secret clearance may be acceptable with Government approval.
Level II: Bachelor’s degree in a related technical discipline and at least 2 years of direct CND, intrusion detection/prevention, or security tool engineering experience; or an associate degree and at least 4 years; or at least 6 years of relevant professional or military cyber operations experience in lieu of a degree.
Level III: Bachelor’s degree and at least 4 years of relevant experience; or an associate degree and at least 6 years; or at least 8 years of relevant experience or military service in lieu of a degree.
Before starting, hold a valid certification or degree compliant with DoD 8140.03/DCWF Work Role Code 521, Cyber Defense Infrastructure Support Specialist, at Basic or Intermediate level. Accepted certifications listed include Security+ CE, CySA+, CCNA-Security, CND, SSCP, GICSP, GSEC, CASP+ CE, CCNP Security, GCIA, GCIH, and CISSP.
Ability to obtain a required Computing Environment certification within six months of the start date.
Experience writing, testing, and deploying custom intrusion signatures, such as Snort, Suricata, YARA, or Bro/Zeek, and firewall/ACL rules.
Working administrative knowledge of Cisco FirePOWER Management Center, IDS/IPS appliances, and proxy or web content filtering solutions.
Deep understanding of TCP/IP, UDP, ICMP, DNS, HTTP/S, TLS, and packet-inspection tools such as Wireshark and tcpdump.
Familiarity with adversary tactics, techniques, and procedures and the MITRE ATT&CK framework.
Ability to participate in an on-call rotation for emergency after-hours surge or high-priority operational containment events.

Nice To Haves

Prior experience supporting DISA or Service Cyber Components such as ARCYBER, AFCYBER, FLTCYBER, or MARFORCYBER.
Hands-on experience developing automated incident-response workflows or SOAR playbooks, such as Cortex XSOAR, Splunk SOAR/Phantom, or Sentinel Logic Apps.
Scripting expertise in Python, PowerShell, Bash, or Regex for signature creation and data parsing.
Knowledge of EDR platforms such as Microsoft Defender for Endpoint, Tanium, or CrowdStrike and their containment actions.
Familiarity with DoD security policies including DoDI 8530.01 and CJCSM 6510.01F, and incident-tracking databases such as Rally.

Responsibilities

Design, author, test, and deploy custom detection and prevention signatures for antivirus, network intrusion detection/prevention, web content filtering, and enterprise recursive services.
Develop and tune active countermeasures across enterprise boundaries, including Internet Access Points, Boundary Cloud Access Points, and DODIN DMZs.
Analyze automated-blocking telemetry, assess blocked and allowed traffic, investigate events that bypassed defenses, and refine blocking algorithms to reduce false positives and false negatives.
Track deployed customer and enterprise countermeasures and document de-confliction actions and configuration management changes.
Maintain and execute rapid-rollback procedures to restore network devices and sensors to their operational baseline when defensive actions affect mission availability, while following government-directed network freezes.
Manage the lifecycle of signatures and detection rules, including periodic reviews, tuning, retirement of outdated detections, and monthly custom-countermeasure reporting.
Develop and execute countermeasures across enterprise cloud and Zero Trust environments, including Joint Warfighter Cloud Capability providers, Thunderdome ZTNA, and Microsoft Defender.
Work with threat analysts to translate warning intelligence and Attack Sensing and Warning data into countermeasures, automate repeatable mitigations, and turn tactical hunt hypotheses into production analytics.
Analyze incident-response and defense-performance trends and contribute to the monthly Respond Statistical and Trend Report.
Ensure containment and countermeasure actions comply with CJCSM 6510.01F and DoDI 8530.01, record response data in Rally, and provide technical mitigation recommendations to the DISA Joint Operations Center.
Develop and deploy specialized countermeasures for PACOM Mission Network and Joint Operational Edge – Coalition Environment architectures, using Mission Edge Compute endpoints, identity and access integrations, and User and Entity Behavior Analytics.
Identify opportunities for security orchestration and author or improve SOAR playbooks, custom API workflows, and scripts to automate containment.
Apply countermeasures in SCIF-based classified enclaves up to Top Secret/SCI, including JWICS and YLAN.
Coordinate technical responses and rule modifications with DISA, USPACOM J6, DoD Cyber Defense Command, USCYBERCOM, and commercial vendors.
Participate in an on-call rotation for emergency after-hours surge or high-priority operational containment events.