DAE/SI Cyber Threat Analyst

A.C. Coy•Falls Church, VA

9d•Hybrid

About The Position

Tier One Technologies is seeking a Detection & Automation Engineering (DAE) / Super Intelligence (SI) Cyber Threat Analyst to support a direct U.S. Government client. This semi-remote contract-to-hire position may be based in Falls Church, Virginia; Raleigh, North Carolina; or Eagan, Minnesota. Selected candidates who do not already have the required clearance will be subject to a federal government background investigation to receive it. The analyst will support CISO Operations by designing, implementing, and maintaining automated and SI-enabled security detection and integration capabilities across enterprise security monitoring technologies. The role focuses on improving threat detection and response through detection engineering, security automation, systems integration, data analysis, and continuous improvement of detection content and workflows. The analyst will work with security operations, threat intelligence, and incident response stakeholders, and will produce documentation and operational processes to support reliable operations.

Requirements

Degree from an accredited college or university in the applicable field; if the degree is not in the applicable field, four additional years of related experience are required.
At least 8 years of experience in cybersecurity operations, threat hunting, and incident response.
One or more of the following certifications: CISSP, CISA, CISM, GIAC, or RHCE.
Excellent oral and written communication skills.
Must be able to obtain a Position of Public Trust clearance.
Must be a U.S. citizen or lawful permanent resident (Green Card holder).
Must have lived in the United States for the past five years and must not have spent more than six months traveling outside the United States during that period; military service is excluded.

Nice To Haves

Knowledge of SOAR tools such as SentinelOne, SentinelOne Hyperautomation, and Splunk SOAR.
Knowledge of Splunk Enterprise Security.
Knowledge of SOC operations and processes.
Knowledge of the threat intelligence lifecycle and analysis.
Knowledge of incident response methodologies.
Knowledge of network protocols and architecture.
Knowledge of Windows, Linux, and Unix operating systems.
Knowledge of AWS, Azure, or GCP cloud platforms.
Knowledge of security architecture and design.
Programming or scripting skills in Python, PowerShell, or Bash.
Knowledge of API integration and development.
Knowledge of detection engineering methodologies.
Knowledge of security automation and orchestration concepts.
Knowledge of NIST SP 800-53 Security Controls, CIS Controls, and the MITRE ATT&CK Framework.
Beneficial knowledge of the CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars and Federal Cybersecurity Directives, the Privacy Act, malware analysis, digital forensics procedures, risk assessment methodologies, and machine learning and SI for security.

Responsibilities

Design, implement, and maintain automated and SI-enabled security detection and integration capabilities across enterprise security monitoring technologies.
Improve threat detection and response through detection engineering, security automation, systems integration, data analysis, and continuous improvement of detection content and workflows.
Build automation/SI and integration workflows to improve detection and response.
Integrate and optimize security technologies, including SIEM, EDR, SOAR, and threat intelligence, into a cohesive detection architecture.
Analyze requirements and translate operational security needs into technical specifications and implementable solutions.
Test, evaluate, and validate detections and automation/SI workflows, and drive improvements based on results and operational feedback.
Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.
Create and maintain technical documentation, SOPs, and runbooks.
Coordinate with SOC, threat intelligence, and incident response teams to align detections with threat priorities and operational processes.
Research and assess new security and SI/ML capabilities to enhance detection effectiveness.