Cyber Technical Intelligence Analyst

City of New York•New York, NY

22h

About The Position

The NYC Department of Buildings (DOB) is seeking a Cyber Technical Intelligence Analyst to perform critical functions within its Threat Management discipline. The role consumes and analyzes tactical and technical intelligence and coordinates between New York City Cyber Command and the Office of Technology & Innovation Information Security. The analyst supports threat investigations, threat hunting, detection engineering, incident response, risk analysis, and security operations across DOB’s IT environment, including on-premises and cloud assets. The position may be eligible for remote work up to two days per week under the Remote Work Pilot Program.

Requirements

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position, or equivalent education and/or experience.

Responsibilities

Provide intelligence support and directly assist with or execute investigative efforts and tasks.
Assist threat-hunting missions to augment detection capabilities and identify threats across DOB’s IT operating environment.
Collect, process, analyze, and disseminate tactical intelligence, including indicators of compromise, and finished intelligence reports.
Develop, maintain, and execute threat and risk communication processes.
Perform network, system, and kill-chain analysis to determine how malware was introduced and propagated.
Research and track code families, campaigns, and threat actors through technical analysis of data, malicious code, and infrastructure.
Use predictive analytic methods to assess changes in adversary capabilities, motivations, and intent, and recommend ways to reduce risk before exposure to threats.
Analyze network traffic and server or cloud performance metrics to identify anomalous activity and potential threats.
Resolve New York City Cyber Command Security Operations Center remediation requests.
Provide analytical support, threat hunting, and detection engineering to the Security Operations Center, including Incident Response and Risk Analysts, by adding intelligence context to active investigations and threats.
Follow up on incident reports and application scan reports to ensure timely mitigation.
Investigate suspicious traffic and identify potential attacks, false positives, and missed detections.
Conduct network monitoring and intrusion detection analysis using computer network defense tools, including intrusion detection and prevention systems, firewalls, and host-based security systems; review and adjust access control lists as needed based on source, destination, and port requirements.
Conduct log-based and endpoint-based threat detection to identify and protect against threats from multiple sources.
Correlate activity across endpoints, networks, and applications, and across on-premises and cloud environments, to identify patterns of anomalous or suspicious activity.
Support business continuity and disaster recovery plans, conduct disaster recovery tests, publish test results, and make changes to address deficiencies.
Research emerging threats and vulnerabilities to assist in identifying incidents.
Provide incident response support to users, including containment actions and facilitating forensic analysis when necessary.
Design, implement, audit, and maintain ThreatLocker policies.
Manage ThreatLocker Application Whitelisting, Ringfencing, Storage Control, and Elevation Control.
Use PowerShell, Python, Power Automate, and Microsoft Graph API for scripting and automation to improve mobile service capabilities.
Serve as a subject matter expert in mobile device management architecture, device management, and security.
Create and present custom threat briefing materials for tactical situational awareness.
Handle special projects and initiatives as assigned.