Defensive Cyberspace Operations (DCO) SME

Quantum Sky•Colorado Springs, CO

9d•$115,000 - $130,000•Onsite

About The Position

Quantum Sky is seeking a Defensive Cyber Operations (DCO) Subject Matter Expert (SME) to support the United States Space Force (USSF) Space Operations Command (SpOC) Intelligence and Cyber Defense for the Enterprise Services (SPICES) contract. The SME supports the development, proficiency, and operational effectiveness of USSF Cyber Squadron personnel through employment of DCO capabilities, intrusion detection monitoring and analysis, identification of malicious cyber activity and attack vectors, cyber response activities, defensive countermeasure development, and subject matter expertise for USSF Cyber Guardians. The position provides technical and operational support for space mission systems, including incident analysis and response, cyber mission planning, crew operations, capability assessment, and development of squadron-level procedures and training materials. The role also advises government personnel on monitoring, baselining, mission-relevant cyber terrain, cyber operations, and post-mission analysis. The position is located at Schriever AFB in Colorado Springs and follows a Monday–Friday day-shift schedule.

Requirements

At least one active DoD 8570.07-M Cyber Security Services Provider (CSSP) Analyst or Incident Responder certification: CEH, CySA+, GCIH, GCIA, CFR, CCNA Cyber Ops, CCNA-Security, GICSP, Cloud+, SCYBER, PenTest+, CHFI, or GCFA.
Six years of cybersecurity analyst work experience or equivalent.
Experience in cybersecurity monitoring, cybersecurity analysis, intrusion detection, and/or cyber incident response.
Experience performing continuous cybersecurity monitoring, intrusion detection, and cyber incident response.
Experience with ELK Stack, Kibana, Suricata, Splunk, Snort, Wireshark, Bro/Zeek logs, tcpdump, editcap, LogRhythm, ePo/HBSS, ACAS, SolarWinds, Microsoft Office 365, and Active Directory WMIC commands.
Active DoD TS/SCI clearance.
IAT Level III certification under DoD 8570.07-M; qualifying certifications include CASP+ CE, CCNP Security, CISA, CISSP or CISSP Associate, GCED, GCIH, and CCSP.

Nice To Haves

Cybersecurity Service Provider (CSSP) experience is preferred.
Familiarity with Space Operations is highly desired.
Eight or more years of relevant cybersecurity experience.

Responsibilities

Develop operational and technical materials to increase crew proficiency.
Recommend cyber defense remediation and mitigation implementations for incidents and events.
Support Operational Planning Teams and crew shift planning, including planning participation, recommending courses of action (COAs), and validating technical approaches against mission objectives.
Draft and validate squadron-level DCO Tactics, Techniques, and Procedures (TTPs), Standard Operating Procedures (SOPs), Operational Instructions (OIs), crew operations products, evaluation materials, and related materials.
Analyze new DCO-Space capability releases, assess functionality, and inform operational employment.
Attend meetings, teleconferences, and video teleconferences at Unclassified, Secret, and TS/SCI levels as required.
Recommend exercises and mission rehearsals.
Maintain proficiency by performing DCO crew operations for assigned space mission systems.
Provide expertise on DCO-Space capabilities, including SIEM, intrusion detection and prevention systems, ELK Stack, endpoint protection, SOAR, firewalls, log aggregators, protocol analyzers, and vulnerability assessment tools.
Augment and advise crews conducting intrusion detection monitoring and analysis.
Provide input to Cyber 9-Lines and review cyber incident inputs for SITREPs and MISREPs for accuracy.
Advise and assist with cyber incident response processes under squadron policies and procedures.
Analyze incidents, determine their nature, formulate response recommendations, correlate event and incident data across assigned space mission systems, determine actions, and assess possible effects on those systems.
Participate in Government-established Cyber Incident Response Teams (CIRTs), assess cyber events and their impacts, develop and recommend mitigation or remediation COAs, and maintain situational awareness for system owners, operators, and leadership through recurring status reports or update briefs.
Provide technical expertise in developing COAs, including suggested timing and sequencing, to mitigate or remediate cyber threats to space mission systems.
Participate in post-incident hot washes and lessons-learned processes as required by the Government.
Recommend incident-response best practices to improve TTPs, processes, and policies.
Recommend ways to optimize DCO-Space capabilities, including developing countermeasures such as signatures, rules, and policies to reduce false positives, prioritize actionable alerts, and improve correlation accuracy.
Assist government personnel in identifying, documenting, and tracking normal baseline activity by monitoring, collecting, and analyzing system traffic and reviewing, auditing, and analyzing network and endpoint logs.
Assist government personnel with Mission Relevant Terrain–Cyber (MRT-C) identification and mapping using Functional Mission Analysis–Cyber (FMA-C) concepts.
Assist government personnel in conducting cyber missions—including Survey, Recon, Escort, Hunt, Strike, and Recover—to detect, track, and disrupt APTs that evade existing controls and detection capabilities.
Provide inputs to the post-mission analysis process for cyber missions as required by the Government.
Recommend cyber mission best practices to improve TTPs, processes, and policies.