Cyber Technical Intelligence Analyst

City of New York•New York, NY

1d•$75,000 - $109,538•Hybrid

About The Position

The Cyber Technical Intelligence Analyst performs critical functions within the Threat Management discipline at the NYC Department of Buildings. The role consumes and analyzes tactical and technical intelligence and coordinates between New York City Cyber Command and the Office of Technology & Innovation Info Sec. The analyst supports threat investigations, threat hunting, detection engineering, incident response, and risk analysis across the Department’s IT environment, including on-premises and cloud environments. The position may be eligible for remote work up to two days per week under the Remote Work Pilot Program.

Requirements

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position, or equivalent education and/or experience.
Experience or expertise related to mobile device management architecture, device management, and security is associated with the stated subject matter expert duties.

Responsibilities

Provide intelligence support and directly assist with or execute investigative efforts and tasks.
Assist hunt missions to augment detection capabilities and identify threats across DOB’s IT operating environment.
Collect, process, analyze, and disseminate tactical intelligence, including indicators of compromise, and finished intelligence reports.
Develop, maintain, and execute threat and risk communication processes.
Perform network, system, and kill-chain analysis to determine how malware was introduced and propagated.
Research and track code families, campaigns, and actors through technical analysis of data, malicious code, and infrastructure.
Use predictive analytics to assess changes in adversaries’ capabilities, motivations, and intent, and recommend ways to reduce risk before exposure to threats occurs.
Analyze network traffic and server/cloud performance metrics to identify anomalous activity and potential threats.
Resolve New York City Cyber Command Security Operations Center remediation requests.
Provide intelligence-based analytic support, threat hunting, and detection engineering to the Security Operations Center, including Incident Response and Risk Analysts, to add context to active investigations and threats.
Follow up on incident reports and application scan reports to ensure timely mitigation.
Investigate suspicious traffic and identify potential attacks, false positives, and missed detections.
Monitor networks and analyze intrusion detection activity using computer network defense tools, including intrusion detection/prevention systems, firewalls, and host-based security systems; review and adjust access control lists as needed based on source, destination, and port requirements.
Conduct log-based and endpoint-based threat detection to identify and protect against threats from multiple sources.
Correlate activity across endpoints, networks, and applications, and across on-premises and cloud environments, to identify anomalous or suspicious patterns.
Support business continuity and disaster recovery planning, including conducting recovery tests, publishing test results, and making changes to address deficiencies.
Research emerging threats and vulnerabilities to help identify incidents.
Provide incident response support to users, including containment actions and facilitation of forensic analysis when necessary.
Design, implement, audit, and maintain ThreatLocker policies.
Manage ThreatLocker Application Whitelisting, Ringfencing, Storage Control, and Elevation Control.
Use PowerShell, Python, Power Automate, and Microsoft Graph API scripting and automation tools to improve mobile service capabilities.
Serve as a subject matter expert in mobile device management architecture, device management, and security.
Create and present custom threat briefing materials for tactical situational awareness.
Handle special projects and initiatives as assigned.