DAE/SI Cyber Threat Analyst

A.C. Coy•Falls Church, VA

10d•Hybrid

About The Position

Tier One Technologies is seeking a Detection & Automation Engineering (DAE) / Super Intelligence (SI) Cyber Threat Analyst to support its direct U.S. Government client. This semi-remote contract-to-hire position can start in Falls Church, Virginia; Raleigh, North Carolina; or Eagan, Minnesota. Selected candidates who do not already have the required clearance will be subject to a federal government background investigation to receive it. Candidates must be U.S. citizens or permanent residents, have lived in the United States for the past five years, and have no more than six months of travel outside the United States during that period; military service is excluded from the travel restriction. The analyst supports CISO Operations by designing, implementing, and maintaining automated and Super Intelligence security detection and integration capabilities across enterprise security monitoring technologies. The role improves threat detection and response through detection engineering, security automation, systems integration, data analysis, SI/ML capabilities, and ongoing improvement of detection content and workflows. The analyst works closely with security operations, threat intelligence, and incident response stakeholders and supports reliable operations through documentation and operationalization practices.

Requirements

A degree from an accredited college or university in the applicable field; if the degree is not in the applicable field, four additional years of related experience are required.
At least 8 years of experience in cybersecurity operations, threat hunting, and incident response.
One or more of the following certifications: CISSP, CISA, CISM, GIAC, or RHCE.
Excellent oral and written communication skills.
Must be able to obtain a Position of Public Trust clearance.
Must be a U.S. citizen or permanent resident (Green Card holder).
Must have lived in the United States for the past five years.
Must not have spent more than six months traveling outside the United States within the last five years; military service is excluded.
Knowledge of SOAR tools, including SentinelOne, SentinelOne Hyperautomation, Splunk Enterprise Security, and Splunk SOAR.
Knowledge of Super Intelligence (SI) security, SOC operations and processes, threat intelligence lifecycle and analysis, and incident response methodologies.
Knowledge of network protocols and architecture; Windows, Linux, and Unix operating systems; and AWS, Azure, or GCP cloud platforms.
Knowledge of security architecture and design, programming or scripting with Python, PowerShell, or Bash, API integration and development, detection engineering methodologies, and security automation and orchestration concepts.
Knowledge of NIST SP 800-53 Security Controls, CIS Controls, and the MITRE ATT&CK Framework.

Nice To Haves

Knowledge of the CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars and federal cybersecurity directives, the Privacy Act, malware analysis, digital forensics procedures, risk assessment methodologies, and machine learning and SI for security.

Responsibilities

Support CISO Operations in designing, implementing, and maintaining automated/Super Intelligence security detection and integration capabilities across enterprise security monitoring technologies.
Improve threat detection and response through detection engineering, security automation, systems integration, data analysis, and continuous improvement of detection content and workflows.
Build automation/SI and integration workflows to improve detection and response.
Integrate and optimize security technologies, including SIEM, EDR, SOAR, and threat intelligence tools, into a cohesive detection architecture.
Analyze requirements and translate operational security needs into technical specifications and implementable solutions.
Test, evaluate, and validate detections and automation/SI workflows; drive improvements based on results and operational feedback.
Analyze telemetry to identify anomalies, trends, and detection gaps, and recommend and implement detection enhancements.
Create and maintain technical documentation, SOPs, and runbooks.
Coordinate with SOC, threat intelligence, and incident response teams to align detections with threat priorities and operational processes.
Research and assess new security and SI/ML capabilities to enhance detection effectiveness.