Cybersecurity Analyst

SAIC•San Antonio, TX

17h•Onsite

About The Position

Science Applications International Corporation (SAIC) is seeking a senior network security analyst to join our team supporting a major state & local government customer. This position reports to the Security Director. This is an on-site role to act as an analyst and tool admin for Armis. The work is performed in a State Agency managed Security Operations Center (SOC). Duties are primarily categorized as Tool Admin and Analyst, Incident Investigation and Response, Security Operations, Incident Management, or similar roles. SAIC® is a premier mission integrator focused on advancing the power of technology and innovation to serve and protect our world. Our robust portfolio of offerings across the defense, space, intelligence, and civilian markets includes secure high-end solutions in mission IT, enterprise IT, engineering services, and professional services. We integrate emerging technology, rapidly and securely, into mission critical operations that modernize and enable critical national imperatives. We are approximately 23,000 strong; driven by mission, united by purpose, and inspired by opportunities. SAIC is an Equal Opportunity Employer. Headquartered in Reston, Virginia, SAIC has annual revenues of approximately $7.3 billion.

Requirements

Senior network security analyst
Analyst and tool admin for Armis
Armis Centrix tool admin
SOC Tier 3
Security Incident Response Team operations support
Network security
Cybersecurity defense & analysis
Incident response
Threat analysis
Exploitation analysis
Vulnerability analysis
Incident investigations
Utilizes COTS/GOTS applications
Utilizes ticketing systems
Utilizes lab systems
Utilizes forensic applications
Utilizes custom tools, techniques, and procedures (TTPs)
Utilizes threat intelligence
Obtains information and evidence for legal proceedings
Works with system owners to restore affected systems
Coordinates with contracted vendors
Researches, evaluates, and recommends new security tools, techniques, and technologies
Supports cyber metrics development, maintenance, and reporting

Responsibilities

Hybrid role as an Armis Centrix tool admin and SOC Tier 3, with the potential to be required to support Security Incident Response Team operations.
Supports dedicated work functions for state government agency.
Own and manage baseline configurations, policies, and implementation of front-end operations for Armis.
Work with Armis as a vendor for architecture and engineering implementation concerns.
Performs network security, cybersecurity defense & analysis, incident response, threat analysis, exploitation analysis, vulnerability analysis, and incident investigations.
Utilizes COTS/GOTS applications, ticketing systems, lab systems, forensic applications, and/or custom tools, techniques, and procedures (TTPs) to monitor systems for abnormal events and determine if events are to be deemed an incident.
Determines if incidents are due to malicious or suspicious actions by one or more threat actors.
Utilizes threat intelligence to determine if the incident is part of a named campaign to determine appropriate levels of response, or provide new intelligence based on investigative actions to threat intelligence teams, organizations, and/or external parties.
Obtains information and evidence for legal proceedings or to provide to government counterparts for possible military, law enforcement, and/or counter-intelligence response actions/activities, Human Resources investigations, and/or management action.
Works with system owners to restore affected systems to secure baseline configurations.
Coordinates with contracted vendors for incident control.
Researches, evaluates, and recommends new security tools, techniques, and technologies.
Supports cyber metrics development, maintenance, and reporting for managed tools.
Provides briefings to senior staff and/or state government agencies executive staff.