Cyber Security Operations Specialist I - Tier 1

CACI•Saint Louis, MO

2d•Onsite

About The Position

As the Cyber Security Operations Specialist, you will provide CSOC Tier 1 services, which is 24x7x365 coordination, execution, and implementation of all actions required for the containment, eradication, and recovery measures for events and incidents. CSOC Tier 1 services include recording, investigating, and processing events received via walk-ups, phone calls, email, chat, web, cybersecurity tools, and enterprise tools. The Cyber Security Operations Specialist will require a certification that is compliant with DoD 8140.01 and DoD 8570.01-M IAT Level II (pre-hire requirement) and CSSP Analyst (required to obtain within six months of start date). Shift 4 (Weekends 0600-1800 + 16 hours during the weekday)

Requirements

Must be a US Citizen with an Active TS/SCI to start work, but required to obtain a CI Poly within 6 months.
Bachelors Degree and Two (2) years of job related experience in a CSOC environment.
Additional experience may be considered in lieu of a degree.
DoD 8570.01-M IAT Level II
CSSP Analyst Certification (must be obtained within 6 months of hire date)

Responsibilities

Utilize the SEIM to perform 24/7 monitoring, detection, and initial triage (identify, investigate, categorize, prioritize, ticketing, and forwarding) of events/alerts/incidents.
Create tickets in the agency directed ticketing system for all alerts/incidents.
Obtain and aggregate all artifacts, data, screen shots, and other products from assets within Network Security Services, Endpoint Security Services, Cybersecurity Data Analysis Services, and other NGA assets as needed to complete the ticket for higher tier analysis.
Submit tuning requests as needed to Network Security Services, Endpoint Security Services, and Cybersecurity Data Analysis Services.
Interact with and generate tickets on behalf of CSOC customers through multiple means of communication, to include but not limited to walk-ins, phones, web, email, and text-based chat systems.
Document the steps used to analyze and triage an event/alert/incident with sufficient detail to enable the government and other contract services to systematically reconstruct after tier 1 analysis.
Monitor the CSOC virus submit mailbox and perform initial assessment of emails to determine if they are SPAM, phishing emails, or malware.
Provide custom metrics to support regular and ad hoc reporting requirements (e.g., incident category types, tools used, number of indicators, time opened at each step, trending statistics, service availability, system utilization, etc.).
Provide input to the daily CSOC Significant Activity Report, the daily CSOC Operations Update, and the Weekly CSOC Status Report