Cyber Security Specialist III
About The Position
The Cyber Security Specialist III provides senior operational cybersecurity expertise in incident-management operations and SOC engineering and detection activities. This seasoned technical contributor applies deep technical knowledge to difficult or unclear problems, collaborating and analyzing potential impacts to end solutions. The role covers real-time alert monitoring and triage, incident report acceptance and coordination, incident analysis, containment, eradication and recovery, and SOC engineering, deployment, operations and maintenance. It may also include detection engineering, tuning and development of custom capabilities. The Specialist monitors and analyzes security alerts, logs, events, reports and other cybersecurity data sources; investigates alerts; conducts initial triage; assesses potential severity and impact; documents incidents; and escalates potential incidents according to Government procedures. The role receives, validates, documents, coordinates and maintains incident information, and supports analysis by correlating logs, alerts, artifacts, reports, threat intelligence and other Government-approved sources. The position also supports incident response and recovery, SOC tool operations and technical integration, detection tuning, and the development or maintenance of SOC analytics and related capabilities.
Requirements
- Bachelor's degree; alternatively, three additional years of experience may be substituted for the degree.
- Seven years of experience.
- Deep technical knowledge and experience addressing difficult or unclear technical problems through collaboration and analysis.
Responsibilities
- Conduct real-time monitoring and analysis of security alerts, logs, events and cybersecurity data.
- Investigate alerts and perform initial incident triage and prioritization.
- Conduct retrospective analysis based on threat intelligence, IOCs or Government direction.
- Create and maintain incident cases, tickets, findings and associated documentation.
- Receive, validate, document, coordinate and escalate cybersecurity incident reports.
- Analyze suspected incidents to determine relevant activity, affected systems, IOCs, timelines, severity and potential impact.
- Correlate data from logs, alerts, artifacts, reports and threat intelligence.
- Develop and document recommended response and remediation actions.
- Support containment, eradication, recovery and incident closure.
- Support deployment, operation, maintenance, troubleshooting and sustainment of SOC capabilities.
- Support rule, sensor, alert and analytic tuning.
- Develop or maintain detections, analytics, dashboards, scripts, interfaces, automation playbooks and other SOC capabilities as assigned.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
