Cybersecurity Threat Analyst

Invictus International Consulting, LLC • Colorado Springs, CO

5d • Onsite

About The Position

This role involves supporting proactive threat analysis and hunt activities. The analyst will use established hypotheses, queries, procedures, and data sources to proactively analyze security telemetry. The goal is to identify indicators of compromise, anomalous behavior, and adversary activity that may have evaded automated security controls or not yet met an incident threshold. The position requires assessing and correlating data from various sources, documenting findings, and escalating suspicious activity. The analyst will also contribute to SOC reporting and defensive awareness by providing relevant findings and trends. Researching indicators and adversary behaviors under guidance is also a key part of the role.

Requirements

• Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree.
• Minimum two (2) years of relevant experience in addition to education level.
• Foundational knowledge of common cyber threats, indicators of compromise, network/host artifacts, and security monitoring concepts.
• Ability to document analytical reasoning and communicate findings clearly.
• Must possess current DoD 8570 IAT II or IAM II certification.
• Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph.

Nice To Haves

• Familiarity with SIEM/search technologies, threat intelligence, MITRE ATT&CK, or security data analysis is desired.
• Experience working in a DoD or IC environment desired.

Responsibilities

• Support proactive threat analysis and hunt activities using established hypotheses, queries, procedures, and data sources.
• Proactively analyze security telemetry to identify indicators of compromise, anomalous behavior, and adversary activity that has not met an incident threshold or has evaded automated security controls.
• Assess and correlate data from multiple sources, including network, endpoint, identity, SIEM, threat intelligence, vulnerability, and other available security data.
• Document hunt activity, findings, evidence, and recommended follow-on actions in authorized systems and initiate or support incident-response processes when malicious activity is identified.
• Provide relevant findings and trends for SOC operational reporting, significant-activity reporting, and defensive awareness.
• Research indicators, adversary behaviors, and suspicious activity under guidance from senior threat personnel.
• Maintain clear hunt notes and document negative as well as positive findings to support repeatability and knowledge development.
• Escalate suspicious activity and potential detection gaps to senior threat analysts and watch operations.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level