Cyber Network Defense Analysts (CNDA) Level II

Argo Cyber Systems•Pensacola, FL

8d•$95,000 - $110,000•Onsite

About The Position

Argo Cyber Systems, LLC is seeking a Level II Cyber Network Defense Analyst to support a mission-critical U.S. Government cybersecurity program protecting federal civilian agencies, government networks, and critical infrastructure. The role is based in Pensacola, Florida, and requires U.S. citizenship, an active TS/SCI clearance, and the ability to obtain DHS Suitability. The analyst provides advanced network security monitoring, threat detection, intrusion analysis, and incident response support using host-based, network-based, and cloud-based cybersecurity technologies. The work includes analyzing network traffic and packet data, investigating alerts and potential intrusions, interpreting and supporting the development of detection signatures, documenting and escalating incidents, and communicating findings to cybersecurity teams and leadership. The analyst collaborates with incident responders, network engineers, and enterprise security personnel to improve monitoring and response capabilities.

Requirements

U.S. citizenship.
Active Top Secret / Sensitive Compartmented Information (TS/SCI) security clearance.
Ability to obtain DHS Suitability.
At least 2 years of directly relevant experience conducting cyber defense analysis with industry-standard cybersecurity tools and technologies.
Demonstrated experience detecting and investigating host-based and network-based intrusions.
Experience developing and deploying cybersecurity detection signatures.
Practical experience applying incident handling methodologies and supporting security investigations.
Experience collecting, correlating, and analyzing information from multiple cybersecurity data sources.
Experience conducting network traffic analysis, packet inspection, and cyber defense trend analysis.
Hands-on experience with intrusion detection technologies, including Snort or comparable IDS solutions.
Ability to read, interpret, and analyze intrusion detection signatures.
Experience using network protocol analyzers and packet inspection tools.
Strong understanding of network communications, common protocols, and suspicious traffic patterns.
Ability to conduct packet-level investigations to identify potential malicious activity.
Experience analyzing cybersecurity alerts and distinguishing legitimate network activity from potential threats.
Knowledge of cyber incident identification, documentation, escalation, and response procedures.
Ability to correlate network events and security information from multiple monitoring technologies.
Experience identifying network anomalies, reconnaissance activity, and indicators of potential compromise.
Strong analytical, troubleshooting, technical documentation, and communication skills.
Meet one of the stated education and experience options: a Bachelor of Science degree in Computer Science, Cybersecurity, Computer Engineering, or a related technical discipline; or a high school diploma and at least 4 years of network investigations experience.

Nice To Haves

Python programming or scripting experience supporting cybersecurity analysis and automation.
Experience with the Carnegie Mellon SiLK network traffic analysis tool suite.
Strong mathematical, scientific, or analytical problem-solving background.
Experience supporting enterprise cybersecurity monitoring and incident response operations.
Familiarity with SIEM technologies, including ArcSight or comparable solutions.
Experience with network traffic metadata, security event correlation, and intrusion detection technologies.
Familiarity with network forensic analysis and investigation of suspicious communications.
One or more preferred certifications or training credentials: GIAC Network Forensic Analyst (GNFA), GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Security Essentials (GSEC), CompTIA Advanced Security Practitioner (CASP+), now SecurityX, CompTIA Cybersecurity Analyst (CySA+), CompTIA Network+, CompTIA Security+, Palo Alto Networks-related training or certification (PaLMS), Federal Virtual Training Environment (FedVTE) training, SANS SEC401 training, or ArcSight or comparable SIEM technology certifications.

Responsibilities

Monitor enterprise network traffic and systems for anomalous behavior, suspicious activity, and emerging threats.
Review security alerts from intrusion detection systems, network monitoring technologies, and other cyber defense platforms.
Distinguish malicious activity, potential intrusions, and unauthorized behavior from legitimate network operations.
Correlate events across multiple data sources to identify patterns of compromise and assess the potential scope of cyberattacks.
Analyze network traffic metadata, communications, connections, and traffic characteristics for indicators of compromise, reconnaissance, exploitation, or other malicious behavior.
Investigate and validate cybersecurity alerts, determining their cause, severity, and potential impact on affected systems.
Coordinate with enterprise cyber defense personnel to confirm security events and support incident response.
Document security incidents, investigative findings, event history, status, escalation activities, and potential operational impact.
Escalate confirmed or suspected incidents according to established incident handling procedures.
Analyze malicious activity to identify exploited vulnerabilities, attack methods, and potential consequences for systems and information.
Reconstruct malicious activity and attack sequences using network traffic and other security evidence.
Conduct packet-level analysis and use protocol analyzers and packet inspection tools to investigate communications and validate IDS alerts.
Analyze network protocols and identify applications and operating systems from observed traffic characteristics.
Apply network forensic techniques to support incident investigations and cyber defense analysis.
Interpret intrusion detection signatures and support their development, testing, and deployment, including signatures responding to emerging threats.
Use intrusion detection technologies such as Snort or comparable platforms to identify host-based and network-based threats.
Evaluate detection results to improve threat identification and reduce unnecessary alerts; coordinate detection updates with cybersecurity engineering and operations teams.
Conduct cyber defense trend analysis to identify recurring events, emerging attack patterns, and areas of concern.
Prepare daily summaries of relevant network events, security alerts, and cybersecurity activity.
Communicate technical findings to cybersecurity leadership and operational stakeholders.
Collaborate with incident responders, network engineers, and enterprise security personnel on investigations.
Contribute to improvements in cyber defense monitoring, incident detection, and operational response procedures.