Cybersecurity Ops Analyst

SAIC•Oak Ridge, TN

1d•Remote

About The Position

SAIC has an opening for a Cybersecurity Ops Analyst. This position is located in Oak Ridge, Tennessee. SAIC is open to the position working remotely. The SAIC Cybersecurity Ops Analyst (Shift Leader) leads advanced security event analysis as part of the 24/7/365 Security Operations Center's Detection & Response team. They manage daily activities using a SIEM, monitoring events from multiple sources while overseeing a team of Cybersecurity Ops Associates. In addition to their incident response duties, the Shift Leader manages the operations of the shift, including timecard and expense approval, as well as daily training and performance tracking. They also participate in threat hunting, intelligence gathering, and strive to improve procedures and processes within the ESOC.

Requirements

Advanced security event analysis
SIEM usage
Monitoring events from multiple sources
Incident response
Threat hunting
Intelligence gathering
Network forensics
Host level forensic via an EDR tool
Documentation of incidents
Communication and escalation of issues
Handling IP/URL/Hash block requests
Developing new correlation content
Second-level real-time monitoring and analysis of security alerts
Delegating event analysis tasks
Providing feedback on tuning for enhanced anomaly detection
Retrieving and reviewing data files associated with security events
Evaluating malicious activity
Reviewing vulnerability information to assess risk
Collaboration with other teams for incident resolution
Training and mentoring Cybersecurity Ops Associates
Approving timecards and expenses
Writing performance reviews
Ensuring shift coverage for 24/7/365 operation
Reviewing and improving documentation procedures
Knowledge sharing

Responsibilities

Lead the identification, prioritization, and response to intrusion activities and anomalous behavior as shift leader on an 24/7/365 Detection & Response Team.
Assess the impact of potentially malicious traffic on the network and infrastructure.
Perform in-depth analysis of security anomalies and incidents using network forensics via a SIEM and host level forensic via an EDR tool.
Document all incidents within the shift and maintain incident tickets.
Communicate and escalate issues and incidents as necessary.
Handle IP/URL/Hash block requests and develop new correlation content.
Conduct second-level real-time monitoring and analysis of security alerts.
Delegate event analysis tasks to Cybersecurity Ops Associates, as required.
Provide feedback on tuning for enhanced anomaly detection.
Retrieve and review data files associated with security events.
Evaluate malicious activity, and review vulnerability information to assess risk.
Collaborate with other teams for incident resolution.
Manage shift operations: Train, mentor, and oversee Cybersecurity Ops Associates, including approving timecards, expenses, providing feedback, writing performance reviews and ensuring shift coverage for 24/7/365 operation.
Continually review and improve documentation procedures
Participate in knowledge sharing
Additional responsibilities will include the ability to train, mentor Cybersecurity Ops Associates