Jr. Cyber Defense Analyst MDX - SSFB/HSV

Amentum•Colorado Springs, CO

1d•$100,000 - $115,000•Onsite

About The Position

The Jr. Cyber Defense Analyst is part of Amentum’s Missile Defense Division and directly supports the Missile Defense Agency. The role performs defensive cyber operations and Cyber Security Service Provider duties, conducting proactive and reactive cybersecurity activities on customer networks to improve enterprise-wide security posture. Work includes detecting, characterizing, investigating, and responding to cyber events and incidents; analyzing threat, vulnerability, and asset data; using cyber threat intelligence to identify indicators of compromise; and documenting findings and incident-response actions while preserving evidence and chain of custody. The analyst also supports development and maintenance of cyber defense procedures and documentation and provides support to insider-threat, law-enforcement, and counterintelligence agencies during investigations. The position is based at Schriever Space Force Base in Colorado Springs, Colorado, or Redstone Arsenal in Huntsville, Alabama. It is not remote or telework eligible. The analyst works rotating shifts in a 24x7x365 operational environment and may need to respond quickly to emergencies. Travel is listed as up to 10% in the posting details; the description also says candidates must be willing to travel 25% of the time. Relocation assistance is not available. The role requires an active DoW Secret clearance or the ability to obtain one, and the ability to obtain and maintain a DoW Top Secret clearance.

Requirements

At least 1 year of general full-time work experience; this may be reduced with completion of advanced education.
At least 6 months of directly related experience in information security, physical security, cybersecurity, enterprise-level monitoring, or a combination of these areas.
Have or obtain within 6 months of hire one of the following certifications: CC (ISC)2, CEH (EC Council), GFACT (SANS), GISF (SANS), or CySA+ (CompTIA).
Have or obtain an active DoW Secret Security Clearance.
Be able to obtain and maintain a DoW Top Secret Security Clearance.
Experience with most Microsoft Office applications, including Word, Excel, PowerPoint, and Visio.
Ability to multitask and prioritize projects and assignments in a dynamic environment to meet scheduled and unscheduled customer requests.
Willingness to work rotating shifts in a 24x7x365 operational environment and respond quickly to emergencies.
Willingness to travel; the posting gives conflicting figures of up to 10% and 25%.

Nice To Haves

Associate’s or bachelor’s degree in Cybersecurity, Computer Science, or a related field.
Experience with security analysis and solutions in a WAN/LAN environment, including routers, switches, network devices, and operating systems such as Windows and Linux.
Experience with SOC/DCO tools and applications such as firewalls, intrusion detection/prevention systems, Network Security Manager, forward proxy, or spam firewall.
Experience analyzing security compliance scans across a WAN; ACAS/Nessus experience preferred.
Experience analyzing network and host-based threats; ESS experience preferred.
Familiarity with Security Operations Centers and the DoD.
Familiarity with DCO/Cybersecurity Service Provider guiding security policies and procedures.

Responsibilities

Perform Defensive Cyber Operations (DCO) and Cyber Security Service Provider (CSSP) duties outlined in Evaluator Scoring Metrics.
Perform proactive and reactive cybersecurity duties on customer networks to improve enterprise-wide security posture.
Conduct preliminary analysis, identification, and response actions to detect, characterize, and respond to cyber incidents in accordance with CJCSM 6510.01B.
Investigate events and incidents from start to conclusion, including gathering data, analyzing it, and reporting findings.
Document all steps in the incident-response process while preserving and protecting incident artifacts, evidence, and chain of custody.
Analyze correlated asset, threat, and vulnerability data against known adversary exploits and techniques to determine impact and improve network defensive posture.
Support the development, establishment, review, and updating of DCO procedures, processes, manuals, and other documentation.
Use actionable Cyber Threat Intelligence to search for indicators of compromise and recommend improvements.
Review ongoing intrusions or cybersecurity incidents and report, analyze, and document findings in accordance with CJCSM 6510.01B guidelines.
Support internal and external insider-threat, law-enforcement, and counterintelligence agencies during cyber incidents and investigations.
Work rotating shifts in a 24x7x365 operational environment and respond quickly to emergencies as needed.
Travel as required; the posting lists up to 10% travel and separately states willingness to travel 25%.