Cybersecurity Incident Response & Threat Detection Analyst

DirectViz Solutions, LLC•Columbus, OH

6d•Onsite

About The Position

DirectViz Solutions (DVS) is seeking an experienced Cybersecurity Incident Response & Threat Detection Analyst to support a 24x7x365 cybersecurity operations environment. This position is responsible for monitoring, detecting, analyzing, and responding to cybersecurity threats and suspicious activity across a large enterprise network. The analyst will monitor SIEM and other cybersecurity tools, investigate security alerts and logged events, identify indicators of attack or compromise, and support incident response activities. The role requires experience identifying sophisticated threats, including Advanced Persistent Threats (APT) and "low and slow" attacks.

Requirements

Five (5) years relevant experience
Two (2) years performing root cause analysis of cybersecurity events and incidents.
Working knowledge of at least two types of security tools: Firewall, IDS/IPS, Host based antivirus, Data loss prevention, Vulnerability Management, Forensics, Malware Analysis, Device Hardening
Understanding of Defense-in-Depth
Ability to build scripts and tools to enhance threat detection and incident response capabilities (Preferably in SPL, Python, PowerShell)
Must possess a DOD TOP SECRET Clearance and be eligible for an IT-1 and be eligible for SCI access.

Responsibilities

Monitor SIEM, network traffic, security logs, and cybersecurity monitoring tools for suspicious or unauthorized activity.
Analyze security alerts and events to identify potential attacks, compromises, and emerging threats.
Investigate cybersecurity incidents and perform root cause analysis.
Monitor for Advanced Persistent Threats (APT) and other sophisticated attack techniques.
Use threat intelligence and Open Source Intelligence (OSINT) to identify and investigate potential threats.
Support incident response activities and implementation of appropriate defensive actions.
Analyze trends across security events to identify patterns indicative of malicious activity.
Provide technical support for enterprise cybersecurity tools and applications.
Support Defense-in-Depth security controls, signatures, and perimeter defenses.
Develop scripts, tools, and automation to improve threat detection and incident response capabilities.