Cyber Monitoring Signature Analyst - Active Secret

Peraton•Beltsville, MD

4d•Onsite

About The Position

Peraton is seeking a Cyber Monitoring Signature Analyst to join the Department of State (DoS) Diplomatic Security Cyber Mission (DSCM) program. This role is part of the Cyber Incident Response Team and focuses on enhancing threat detection and response capabilities using advanced cyber monitoring tools. The analyst will work collaboratively with senior engineers, threat analysts, and incident responders to safeguard a global IT infrastructure from sophisticated threat actors.

Requirements

Bachelor's degree and 2 years of relevant experience; or, 0 years with a Masters degree. An additional 4 years of experience in lieu of the bachelors degree will be considered.
Must possess and maintain one of the following certifications or the ability to obtain before start date: CCNA-Security, CND, CySA+, GICSP, GSEC, Security+ CE, SSCP
Hands-on experience authoring and tuning SPL in a production Splunk environment (minimum 3 years).
Working knowledge of Splunk Enterprise Security (correlation searches, notable events, Incident Review, Adaptive Response) - ES 8.x experience strongly preferred.
Demonstrated experience with the Splunk Common Information Model (CIM) and writing performant searches against accelerated data models.
Experience modifying Splunk ES searches, macros, and lookup tables.
Familiarity with the MITRE ATT&CK framework and its application to detection engineering.
Working knowledge of Zeek, Suricata, and at least one EDR.
Demonstrated knowledge of the Incident Response Lifecycle and how it applies to cloud, legacy, and hybrid environments.
Strong organizational skills.
Proven ability to operate in a time-sensitive environment.
Proven ability to effectively communicate orally and in writing.
U.S. Citizenship is required
Active Secret clearance with the ability to obtain a Top Secret security clearance.

Nice To Haves

Prior experience operationalizing Splunk ES Content Updates (ESCU) analytic stories and Risk-Based Alerting (RBA) workflows.
Experience with Splunk Mission Control for triage, investigation, and response workflows.
Understanding of CVEs, zero-day threats, their modes of operation, and threat detection measures.
Working knowledge of Python and search syntax like Regex.
Knowledge of network architecture, design, and security.
Knowledge of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to find those system files.
Understanding of policies and procedures to investigate incidents in a computer network.
Knowledge of intersection of on-prem and cloud-based technologies.
Exposure to leading vendor cloud environments (Microsoft Azure/AAD, Google GCP, Amazon AWS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).
Experience with EDR telemetry analysis (Microsoft Defender for Endpoint / Advanced Hunting) and/or web proxy data (Zscaler, Cloudflare).
Experience with threat intelligence platforms and IOC operationalization.
Experience in developing and delivering comprehensive training programs.
Previous Incident Response experience at the analyst level.
Knowledge and familiarity with Detection as Code.
Knowledge and familiarity with implementation of AI-driven workflows.

Responsibilities

Author, tune, and maintain correlation searches, Risk Notables, and Adaptive Response actions within Splunk Cloud Enterprise Security.
Evaluate new analytical detections from open-source libraries and incorporate vetted alerting into a SIEM.
Author new correlational searches in SPL/SPL2 using best practice search methodologies.
Maintain a living MITRE ATT&CK coverage matrix; identify gaps and prioritize with SME.
Ensure proper cohesion and health of SIEM alerting.
Collaborate and assist system engineers with the development, configuration and tuning of cyber security tools.
Operationalize threat intelligence to ensure Indicators of Compromise are actionable in detections.
Provide reporting on detection development metrics (coverage, MTTx, FP rate, notable volume by rule).