Cyber Security Operations Specialist III - Tier 3

CACI•Springfield, VA

24d

About The Position

Provide CSOC Tier 3 services involving 24x7x365 coordination, execution, and implementation of actions for containment, eradication, and recovery during cyber security events and incidents. Services include malware and implant analysis and forensic artifact handling and analysis. When a CIRT is stood up, contractors supporting CSOC Tier 3 operate under the direct control and direction of the Government CIRT Commander. Outside incident response periods, personnel conduct continuous exercises and dry runs to improve response outcomes. Personnel must have or obtain, within six months of starting, a certification compliant with DoDD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Incident Responder. The role supports incident investigation and response for NGA networks and systems, including digital media analysis, malware reverse engineering, adversary attribution, incident reporting, stakeholder coordination, and recovery activities. Work includes documenting response actions so they can be systematically reconstructed, developing reports and recommendations, maintaining authorized scripts and tools, and reviewing closed CSOC Tier 2 tickets for quality. The role requires an active TS/SCI clearance and the ability to obtain a polygraph. A bachelor’s degree and/or six years of cyber security experience is required. A master’s degree and IAT III are desired. Travel may be required up to 10%, local travel.

Requirements

Bachelor’s degree and/or six years of experience in cyber security (CSOS).
Active TS/SCI clearance.
Ability to obtain a polygraph.
DoDD 8140.01 and DoD 8570.01-M IAT Level II and CSSP Incident Responder certification requirements are listed in the qualifications; the position description also states personnel must have or obtain within six months a certification compliant with IAT Level III and CSSP Incident Responder.
Ability to work under the direction of the Government CIRT Commander during CIRT operations.
Up to 10% travel; local travel.

Nice To Haves

Master’s degree.
IAT III.

Responsibilities

Coordinate and implement incident-response tasks, perform analysis, and build and document response activities, including containment measures such as IP blocks, domain blocks, and disabling user accounts when directed by the Government.
Coordinate with the Security and Installations Directorate Office of Counterintelligence, Insider Threat Office, and other law enforcement and counterintelligence personnel for advanced investigation and incident triage.
Collaborate with appropriate authorities to produce security incident reports.
Categorize incidents and events.
Coordinate with other contracts, organizations, activities, and services to ensure incidents are reported, contained, and eradicated; to de-conflict blue/red team activity with open incidents; and to support recovery from incidents and events.
Build timelines, documentation, briefings, and other products that inform stakeholders about response actions, analysis, and the impact of adversary activity and blue-force response actions.
Document actions and analysis in the authorized ticketing system with enough detail to allow systematic reconstruction.
Develop, and when approved by the Government generate and update, reports in JIMS, ICMS, and other authorized reporting systems as directed.
Develop, maintain, and sustain custom scripts, tools, and capabilities to collect and analyze data and respond to incidents; execute them when properly authorized by the Government.
Perform digital media analysis on host, server, and network data, including volatile and non-volatile memory and system artifact collection and analysis.
Develop and identify indicators of compromise for cybersecurity stakeholders and other contract services.
Provide adversary attribution.
Perform malware analysis, malware reverse engineering, and signature development.
Coordinate with CSOC Tier 1 and Tier 2 services to remediate discrepancies and recommend ways to prevent recurrence.
Provide input to and coordinate with stakeholders to develop and deliver daily CSOC Significant Activity Reports, daily CSOC Operations Updates, and Weekly CSOC Status Reports.
Serve as a C-IRT member as required and take direction from the Government C-IRT Commander.
Develop and coordinate courses of action with Government and contract stakeholders and, when authorized, execute Defensive Cyberspace Operations-Internal Defensive Measures on NGA networks and systems.
Develop, document, and provide the Government incident investigation reports within 30 days of C-IRT stand-down, documenting the incident lifecycle and response, including adversary and friendly-force activity, host and network analysis, timelines, and recommendations.
Conduct weekly quality-control reviews of a percentage of closed CSOC Tier 2 tickets for proper analysis, categorization, documentation, and notification.
Conduct continuous exercises and dry runs outside incident response periods.