Cyber Security Fusion Analyst

Leidos•Odenton, MD

1d•Onsite

About The Position

The Cyber Security Fusion Analyst will support the DISA GSM-O II program and the Dept. of War Defense Cyber Command (DCDC) at Fort Meade. GSM-O II provides network operations and cyber defense support to DISA in support of the Dept. of War and Combatant Commands. The analyst supports incident handling, event triage, network analysis, threat detection, trend analysis, metric development, and vulnerability information dissemination. The role uses network monitoring and detection capabilities, threat intelligence, vulnerability information, and varied network data to identify adversary activity, assess risk, investigate potential compromises, and recommend mitigation and countermeasures. The analyst also contributes to Cyber Fusion procedures and methodologies and provides analysis, reporting, metrics, and situational awareness to support enterprise and tactical cyber defense.

Requirements

Active DOW TS/SCI clearance and eligibility for a polygraph.
Bachelor’s degree in a related discipline and 4 years of related experience; additional experience may be accepted in lieu of a degree.
Security+ certification or another equivalent DOW 8570 Level II certification.
In-depth knowledge of network and application protocols, cyber vulnerabilities and exploitation techniques, and cyber threat/adversary methodologies.
Proficiency with analysis datasets, tools, and protocols such as passive DNS, VirusTotal, Recorded Future, TCP/IP, OSI, WHOIS, enumeration, threat indicators, malware analysis results, Wireshark, Splunk, and ArcSight.
Experience with open-source and commercial vendor portals, services, and platforms that provide insight into identifying or combating enterprise threats and vulnerabilities.
Proficiency working with network data such as netflow, PCAP, and custom application logs.

Nice To Haves

Experience with DISN and other Dept. of War networks.
Skill in building extended cybersecurity analytics, including trends and dashboards.
Demonstrated experience briefing Senior Executive Service and General Officer/Flag Officer leadership.
Experience in intelligence-driven defense and/or cyber Kill Chain methodology.
IAT Level III and IAM Level II and III certifications.

Responsibilities

Use network monitoring and detection capabilities—including netflow, custom application protocol logging, signature-based IDS, and full packet capture data—to identify cyber adversary activity.
Support development of Cyber Fusion standard operating procedures and the Cyber Fusion Framework and Methodology based on industry best practices and Department of War instructions, guidance, and policy.
Identify enterprise threats and provide mitigation strategies to improve security and reduce the attack surface.
Use serialized threat reporting, intelligence product sharing, OSINT, and open-source vulnerability information to develop prioritized plans.
Analyze and document malicious cyber actors’ tactics, techniques, and procedures (TTPs), and recommend alignment to vulnerabilities and applicability to the enterprise operational environment.
Discover adversary campaigns, anomalies, and inconsistencies in sensor and system logs, SIEMs, and other data.
Identify, investigate, and rule out system compromises; prepare written analytic summaries and attack life-cycle visualizations.
Provide risk assessments and recommendations based on analysis of technologies, threats, intelligence, and vulnerabilities.
Recommend adjustments to enterprise or tactical countermeasures for threats impacting the DOWIN.
Collect analysis metrics and trending data, identify key trends, and provide situational awareness on those trends.