Cyber Countermeasure Specialist

Quantum Sky•Miami Springs, FL

10d•$95,000 - $120,000•Onsite

About The Position

Quantum Sky is seeking an experienced Cyber Countermeasure Specialist to join its Network Assurance and Defensive Cyber Operations (DCO) team supporting the Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The position operates under the Global Services Management – Operations II (GSM-O II) Task Order 22 (TN22) Boundary Cyber Defense and Cybersecurity Services Provider (CSSP) contract. The mission is to protect the Department of Defense Information Network (DODIN/DISN), U.S. Pacific Command (USPACOM), and aligned mission partner enclaves from sophisticated advanced persistent threats and nation-state cyber actors. The specialist connects threat intelligence, incident analysis, and active network defense. The role engineers, tests, validates, deploys, de-conflicts, and tracks custom detection signatures, firewall rules, automated blocking mechanisms, and mitigation actions across boundary sensors, cloud access points, enterprise SIEM platforms, and specialized networks. Work spans Unclassified (NIPRNet) and Secret (SIPRNet) environments up to Top Secret/SCI, including SCIF-based operations at Ford Island. The position also supports multi-cloud and Zero Trust defense, specialized Pacific mission networks, defensive automation, and coordination with military, government, and commercial partners. The specialist must be able to participate in an on-call rotation for emergency after-hours surge or high-priority containment events.

Requirements

For Level II (Intermediate): a bachelor’s degree in cybersecurity, computer science, computer engineering, information systems, or a related technical discipline and at least 2 years of direct CND, intrusion detection/prevention, or security tool engineering experience; or an associate degree and at least 4 years of experience; or at least 6 years of relevant professional or military cyber operations experience in lieu of a degree.
For Level III (Senior): a bachelor’s degree and at least 4 years of relevant experience; or an associate degree and at least 6 years of experience; or at least 8 years of relevant experience or military service in lieu of a degree.
Before the start date, hold a valid certification or degree compliant with DoD 8140.03 / DCWF Work Role Code 521: Cyber Defense Infrastructure Support Specialist (Basic or Intermediate level). Accepted certifications include CompTIA Security+ CE, CySA+, CCNA-Security, CND, SSCP, GICSP, GSEC, CASP+ CE, CCNP Security, GCIA, GCIH, or CISSP.
Ability to obtain the required Computing Environment certification within 6 months of the start date; examples include Cisco Certified CyberOps Associate/Professional, a Cisco FirePOWER specialist credential, Snort Rule Writing certification, or Microsoft SC-200.
Proven experience writing, testing, and deploying custom intrusion signatures, such as Snort, Suricata, YARA, or Bro/Zeek, and configuring firewall or ACL rules.
Working administrative knowledge of Cisco FirePOWER Management Center (FMC), IDS/IPS appliances, and proxy or web content filtering solutions.
Deep understanding of network protocols including TCP/IP, UDP, ICMP, DNS, HTTP/S, and TLS, and packet inspection tools such as Wireshark and tcpdump.
Familiarity with adversary tactics, techniques, and procedures (TTPs) and MITRE ATT&CK.
Ability to participate in an on-call rotation for emergency after-hours surge or high-priority operational containment events.
Must be a U.S. citizen.
Active Top Secret security clearance with eligibility to obtain SCI access upon start (Tier 5 / SSBI investigation within scope). Candidates with an active Secret clearance may be considered if Top Secret/SCI processing begins immediately upon hire with government approval.

Nice To Haves

Prior experience supporting DISA or Service Cyber Components such as ARCYBER, AFCYBER, FLTCYBER, or MARFORCYBER.
Hands-on experience developing automated incident-response workflows or SOAR playbooks, such as Cortex XSOAR, Splunk SOAR/Phantom, or Sentinel Logic Apps.
Scripting expertise in Python, PowerShell, Bash, or regular expressions (Regex) for signature creation and data parsing.
Knowledge of endpoint detection and response platforms such as Microsoft Defender for Endpoint, Tanium, or CrowdStrike, including containment actions.
Familiarity with DoD security policies including DoDI 8530.01 and CJCSM 6510.01F, and incident tracking databases such as Rally.

Responsibilities

Design, author, test, and deploy custom detection and prevention signatures for antivirus, network intrusion detection and prevention systems, web content filtering, and enterprise recursive services.
Develop countermeasures against threats such as zero-day exploits, spear-phishing, Java and Adobe vulnerabilities, and SQL injection attacks.
Tune perimeter defenses across DISA Enterprise Boundaries, including Internet Access Points, Boundary Cloud Access Points, and DODIN DMZs, using the specified sensors and security platforms.
Analyze automated blocking telemetry to assess blocked and allowed traffic, investigate events that bypass defenses, and refine blocking algorithms to reduce false positives and false negatives.
Track customer and enterprise countermeasures and document de-confliction and configuration management actions to preserve synchronized defenses and network stability.
Maintain and execute rapid rollback procedures to restore network devices and sensors to their operational baseline if defensive actions affect mission availability, while following government-directed network freezes.
Manage the full lifecycle of signatures and detection rules, including periodic reviews, tuning, retirement of outdated or redundant detections, and monthly reporting.
Develop and execute countermeasures across enterprise cloud and Zero Trust environments, including Joint Warfighter Cloud Capability CSPs, Thunderdome ZTNA, and the Microsoft Defender suite.
Work with threat analysts to translate warning intelligence and Attack Sensing and Warning data into countermeasures, automate repeatable mitigation actions, and turn tactical hunt hypotheses into production analytics.
Analyze incident-response and defense-performance trends and contribute to the monthly Respond Statistical and Trend Report.
Ensure containment and countermeasure actions comply with CJCSM 6510.01F and DoDI 8530.01, record response data in the DoD-mandated Incident Reporting Structure (currently Rally), and provide technical mitigation recommendations to the DISA Joint Operations Center.
Develop and deploy specialized countermeasures for PACOM Mission Network (PMN) and Joint Operational Edge – Coalition Environment (JOE-CE) architectures at DISA PAC.
Identify opportunities for security orchestration, and author or improve SOAR playbooks, custom API workflows, and scripts to automate containment actions.
Perform operations in SCIFs at Ford Island and apply countermeasures across classified enclaves up to Top Secret/SCI, including JWICS and YLAN.
Coordinate technical responses and rule modifications with the DISA Field Office Commander, USPACOM J6, DoD Cyber Defense Command, USCYBERCOM, and commercial vendors.