Cyber Security Operations Specialist III - Tier 3

CACI International•Springfield, VA

1d•$75,200 - $158,100

About The Position

The Cyber Security Operations Specialist III provides CSOC Tier 3 services, coordinating and executing containment, eradication, and recovery measures for cyber security events and incidents. The work includes malware and implant analysis, forensic artifact handling and analysis, and digital media analysis across host, server, and network data. CSOC Tier 3 services operate 24x7x365. During a CIRT activation, contractors take direction from the Government CIRT Commander; outside incident response periods, they conduct exercises and dry runs to improve response outcomes. The specialist coordinates incident response with government, law enforcement, counterintelligence, contract, and other organizational stakeholders. The position documents investigations and response activities, develops incident reports and indicators of compromise, performs malware analysis and signature development, and supports recovery and remediation. Personnel must hold or obtain a certification compliant with DoDD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Incident Responder within six months of starting.

Requirements

Bachelor's degree and/or six years of experience in Cyber Security (CSOS).
Active TS/SCI clearance and ability to obtain a polygraph.
DoDD 8140.01 and DoD 8570.01-M IAT Level II and CSSP Incident Responder qualification, as stated in the required qualifications.
Hold or obtain within six months of start a certification compliant with DoDD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Incident Responder.
Ability to perform incident response, digital media analysis, malware analysis and reverse engineering, and forensic artifact collection and analysis.
Ability to develop and document incident investigation reports, response timelines, courses of action, and recommendations.
Ability to coordinate with Government, contract, cybersecurity, law enforcement, counterintelligence, and other stakeholders.
Ability to obtain authorization before executing custom scripts, tools, capabilities, or Defensive Cyberspace Operations-Internal Defensive Measures.

Nice To Haves

Master's degree.
IAT III.

Responsibilities

Coordinate and implement incident-response tasks, analyze events, and build and document response activities, including containment measures such as IP and domain blocking and disabling user accounts when directed by the Government.
Coordinate with the Security and Installations Directorate Office of Counterintelligence, Insider Threat Office, and law enforcement and counterintelligence personnel for advanced incident investigation and triage.
Collaborate with appropriate authorities to produce security incident reports.
Categorize incidents and events.
Coordinate with other contracts, organizations, activities, and services to ensure incidents are reported, contained, and eradicated.
Coordinate with other contracts, organizations, activities, and services to de-conflict blue- and red-team activity with open incidents and events.
Coordinate with other contracts, organizations, activities, and services to support NGA recovery from incidents and events.
Build timelines, documentation, briefings, and other products to inform stakeholders about response actions, analysis, and the impact of adversary activity and blue-force response actions.
Document actions and analysis in the authorized ticketing system in sufficient detail to permit systematic reconstruction.
Develop and, when approved by the Government, generate and update reports in JIMS, ICMS, or other authorized reporting systems.
Develop, maintain, and sustain custom scripts, tools, and capabilities to collect and analyze data and respond to incidents and events; execute them when authorized by the Government.
Perform digital media analysis on host, server, and network data, including collection and analysis of volatile and non-volatile memory and system artifacts.
Develop and identify indicators of compromise for cybersecurity stakeholders and other contract services.
Provide adversary attribution.
Perform malware analysis and signature development, including malware reverse engineering.
Coordinate with CSOC Tier 1 and Tier 2 services to remediate discrepancies and recommend ways to prevent recurrence.
Provide input to and coordinate with stakeholders to develop and deliver the daily CSOC Significant Activity Report, daily CSOC Operations Update, and Weekly CSOC Status Report.
Serve as a C-IRT member as required and take direction from the Government C-IRT Commander.
Develop and coordinate courses of action with Government and contract stakeholders and, when authorized, execute Defensive Cyberspace Operations-Internal Defensive Measures on NGA networks and systems.
Develop, document, and provide the Government incident investigation reports within 30 days of C-IRT stand-down, documenting the incident lifecycle and response, including adversary and friendly-force activity, host and network analysis, timelines, corrective-action recommendations, and proposed TTPs or other recommendations.
Conduct weekly quality-control reviews of a percentage of closed CSOC Tier 2 tickets to assess analysis, categorization, documentation, and notification.