Cybersecurity Analyst

SAIC•San Antonio, TX

1d•Onsite

About The Position

Science Applications International Corporation (SAIC) is seeking a senior network security analyst to join our team supporting a major state & local government customer. This position reports to the Security Director. This is an on-site role to act as an analyst and tool admin for Armis. Essential duties of this position include: Hybrid role as an Armis Centrix tool admin and SOC Tier 3, with the potential to be required to support Security Incident Response Team operations. Supports dedicated work functions for state government agency. Own and manage baseline configurations, policies, and implementation of front-end operations for Armis. Work with Armis as a vendor for architecture and engineering implementation concerns. Performs network security, cybersecurity defense & analysis, incident response, threat analysis, exploitation analysis, vulnerability analysis, and incident investigations. Work is performed in a State Agency managed Security Operations Center (SOC). Duties are primarily categorized as Tool Admin and Analyst, Incident Investigation and Response, Security Operations, Incident Management, or similar roles. Utilizes COTS/GOTS applications, ticketing systems, lab systems, forensic applications, and/or custom tools, techniques, and procedures (TTPs) to monitor systems for abnormal events and determine if events are to be deemed an incident. Determines if incidents are due to malicious or suspicious actions by one or more threat actors. Utilizes threat intelligence to determine if the incident is part of a named campaign to determine appropriate levels of response, or provide new intelligence based on investigative actions to threat intelligence teams, organizations, and/or external parties. Obtains information and evidence for legal proceedings or to provide to government counterparts for possible military, law enforcement, and/or counter-intelligence response actions/activities, Human Resources investigations, and/or management action. Works with system owners to restore affected systems to secure baseline configurations. Coordinates with contracted vendors for incident control. Researches, evaluates, and recommends new security tools, techniques, and technologies. Supports cyber metrics development, maintenance, and reporting for managed tools. Provides briefings to senior staff and/or state government agencies executive staff.

Requirements

BS Degree and five (5) years or more experience; Masters and three (3) years or more experience; PhD and 0 years related experience.
Complete understanding and wide application of technical principles, theories, and concepts in the cybersecurity field.
Ability to receive assignments in the form of objectives and establish goals to meet outlined objectives.
General knowledge of related IT disciplines.
Candidates must be a US Citizen and be able to pass a CJIS Criminal Justice background investigation and maintain CJIS clearance throughout employment term.
Providing technical solutions to a wide range of difficult problems requiring the analysis of identifiable factors.
Independent determination and development of approaches to solutions with work reviewed upon completion for adequacy in meeting objectives.
Demonstrating good judgment in selecting methods and techniques for obtaining solutions.
Contributing to the completion of specific programs and projects within the government contracting space.
Security+ or higher certifications.

Nice To Haves

ITIL v4 certification preferred (Foundation or above).
CEH, GCIH, BTL2, CASP, or GSP.
Providing technical solutions to a wide range of difficult problems requiring the analysis of identifiable factors.
Independent determination and development of approaches to solutions with work reviewed upon completion for adequacy in meeting objectives.
Demonstrating good judgment in selecting methods and techniques for obtaining solutions.
Contributing to the completion of specific programs and projects.

Responsibilities

Act as an analyst and tool admin for Armis.
Hybrid role as an Armis Centrix tool admin and SOC Tier 3, with the potential to be required to support Security Incident Response Team operations.
Supports dedicated work functions for state government agency.
Own and manage baseline configurations, policies, and implementation of front-end operations for Armis.
Work with Armis as a vendor for architecture and engineering implementation concerns.
Performs network security, cybersecurity defense & analysis, incident response, threat analysis, exploitation analysis, vulnerability analysis, and incident investigations.
Utilizes COTS/GOTS applications, ticketing systems, lab systems, forensic applications, and/or custom tools, techniques, and procedures (TTPs) to monitor systems for abnormal events and determine if events are to be deemed an incident.
Determines if incidents are due to malicious or suspicious actions by one or more threat actors.
Utilizes threat intelligence to determine if the incident is part of a named campaign to determine appropriate levels of response, or provide new intelligence based on investigative actions to threat intelligence teams, organizations, and/or external parties.
Obtains information and evidence for legal proceedings or to provide to government counterparts for possible military, law enforcement, and/or counter-intelligence response actions/activities, Human Resources investigations, and/or management action.
Works with system owners to restore affected systems to secure baseline configurations.
Coordinates with contracted vendors for incident control.
Researches, evaluates, and recommends new security tools, techniques, and technologies.
Supports cyber metrics development, maintenance, and reporting for managed tools.
Provides briefings to senior staff and/or state government agencies executive staff.