Cyber Security Operations Incident Responder/Day- Shift Lead Analyst

TekSynap•Fort Belvoir, VA

3d•$120,000 - $160,000•Onsite

About The Position

TekSynap is seeking a Cyber Security Operations Incident Responder/Lead Analyst to support its prime contract with the Defense Threat Reduction Agency. The role involves investigating, analyzing, documenting, and responding to cyber defense incidents across an enterprise network, as well as developing and refining threat detection use cases and providing shift-level technical guidance. The posting describes the position as a Day-Shift Lead Analyst in the title, but its overview refers to a Swing-Shift Lead Analyst. The listed schedule is Sunday through Thursday, 2 p.m. to 10 p.m., at Fort Belvoir, Virginia, in a professional office environment. Travel is estimated at one to two weeks annually, including rare deployment occasions and training attendance. Applicants must be U.S. citizens and hold an active Top Secret clearance with SCI eligibility. The position requires DoD 8570 IAT II and CSSP Analyst certifications under DoD 8140, along with a bachelor's, master's, or doctoral degree and corresponding experience ranges stated in the qualifications. The target salary range is $120,000 to $160,000. TekSynap offers full-time employees health, dental, and vision coverage; 401(k); life insurance; short- and long-term disability plans; vacation time; and holidays. Employees must comply with vaccination requirements mandated by contract, applicable law, or regulation.

Requirements

Active U.S. citizenship.
Active Top Secret security clearance with SCI eligibility, which must be maintained.
DoD 8570 IAT II certification and CSSP Analyst certification under DoD 8140.
Bachelor's degree with 5–7 years of experience, master's degree with 3–5 years, or Ph.D. with 0–2 years.
In-depth knowledge of DoDI 8530.01, Cybersecurity Activities Support to DoD Information Network Operations.
Proficiency with Splunk SIEM or similar tools.
Experience with cybersecurity architecture principles that achieve cybersecurity framework goals.
Ability to perform cyber incident triage, incident handling, investigation, documentation, and remediation.
Ability to provide technical guidance to Tier I analysts and support shift alert-closure quality.

Nice To Haves

Experience with Elastic or Microsoft Sentinel, listed as a plus.

Responsibilities

Collect and analyze network and host artifacts, including logs, system images, and packet captures, to characterize activity, determine root cause and operational impact, and enable rapid remediation or mitigation of cyber threats.
Triage cyber incidents by determining scope, urgency, and potential impact; identifying vulnerabilities; and recommending timely remediation.
Provide expert technical support and perform real-time cyber defense incident handling, including forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation.
Manage and document cyber defense incidents from initial detection through final resolution.
Provide technical guidance to Tier I analysts and ensure the quality of alert closures for the shift.
Maintain an average of at least two new detection use cases per month during each year of contract execution, based on current threats, the MITRE ATT&CK framework, or Government direction.
Maintain metadata for detection use cases, including the use case, owner, numbers of false and true positives, and average execution time based on incident detection monitoring analyst feedback.
Analyze completed incident records and improve related detection use cases.
Recommend improvements to correlation rules, filters, signatures, or plays to reduce false or benign positives; track and validate refinement requests and provide monthly metrics.
Assist in developing automated execution methods for incident detection use cases that achieve false-positive rates below 10%, and provide monthly reports on new automation actions and results.
Under Government direction and supervision, validate plays by emulating adversary tactics to trigger alerts as part of blue-team activity.
Create detection use cases that successfully detect Red Team penetration-testing activity.
Use the MITRE ATT&CK matrix and other threat frameworks to develop and refine detection use cases, with the goal of automating their execution.
Provide subject matter expertise in creating, editing, and managing signatures, rules, and filters for network defense systems, including network and ESS IDS, IPS, firewalls, web application firewalls, proxies, and SIEM systems.
Act as alternate D&R technical lead when needed and disseminate taskings among the team under the technical lead's guidance.