Junior Security Analyst - SECRET CLEARANCE REQUIRED

DirectViz Solutions, LLC•Herndon, VA

4d•Onsite

About The Position

DirectViz Solutions (DVS) is seeking a Junior Security Analyst to support TSA security operations onsite in Herndon, Virginia. The position requires an active Secret clearance or higher and supports 24x7x365 cyber operations. Staff work one of two overnight schedules: Sunday through Tuesday, 6:00 PM to 6:00 AM, or Thursday through Saturday, 6:00 PM to 6:00 AM. Personnel rotate every other Wednesday for an eight-hour shift, totaling 80 hours over two weeks. The analyst monitors and investigates security events reported by the TSA Security Information and Event Management (SIEM) system, reviews data from enterprise devices and non-traditional sources, and documents investigations and relevant artifacts in the TSA SOC incident tracking system. The role requires experience in a SOC or NOC and familiarity with operating systems, network protocols, and security logs from a broad range of devices and services. DVS describes itself as a rapidly growing government contractor providing IT solutions for government clients. It offers competitive compensation, medical benefits, a 401(k) match, PTO accrual, professional development reimbursement, corporate-funded technology certifications, and employee recognition programs. DVS is an equal opportunity employer and states that it prohibits discrimination and harassment on protected grounds.

Requirements

High school degree.
One to three years of experience working in a SOC or NOC environment performing security event monitoring and analysis.
Active Secret clearance or higher.
Working knowledge of commonly deployed enterprise operating systems, including Windows, OS X, and Linux.
Working knowledge of network communications and routing protocols, including TCP, UDP, ICMP, BGP, and MPLS, and common internet applications and standards, including SMTP, DNS, DHCP, SQL, HTTP, and HTTPS.
Ability to analyze security logs and events from devices and systems such as firewalls, IDS/IPS, HIDS/HIPS, proxies and web filters, vulnerability scans, routers, NetFlow systems, VPN gateways, server event logs, email and host antivirus, desktop security monitoring agents, IP services, NAT devices, MDM, PKI, and cloud security infrastructure.
Ability to maintain focus, perform prolonged desk work involving a computer, mouse, and keyboard, and lift and move objects weighing up to 15 pounds as needed.
Excellent verbal and written communication skills and a strong command of English.
Ability to work independently and collaboratively as part of a team.
Ability to learn and retain routine tasks and processes quickly.
Strong organizational skills, attention to detail, business correspondence proficiency, and self-management capabilities.
Ability to perform the essential functions of the role, with reasonable accommodation available upon request.
Willingness to work the specified overnight shift and rotating Wednesday schedule.

Nice To Haves

Security+, GIAC Security Essentials (GSEC), or equivalent certification.
Experience with Splunk query language.
Experience with IDS/IPS, firewall, and security configurations and signature development.
Experience with PCAP analysis.
Experience with Tanium threat response.
Experience distinguishing legitimate security incidents from non-incidents, including identifying malicious code and malicious activity on computer systems or enterprise networks.
Experience using ticket management systems to collect, document, and maintain information pertinent to security investigations and incidents.
Ability to produce clear and thorough security incident reports and briefings.
Experience monitoring the operational status of monitoring components and escalating and reporting outages.
Conceptual understanding of Windows Active Directory.
Experience with event logging systems and security event log analysis; prior experience with SIEM platforms for log collection, analysis, correlation, and alerting.
Experience identifying and implementing countermeasures or mitigating controls for enterprise network deployment.
Experience collecting and maintaining information pertinent to security investigations and incidents in formats that support analysis, situational awareness reporting, and law enforcement investigation efforts.

Responsibilities

Monitor and analyze security events and alerts reported by the TSA SIEM system on a 24x7x365 basis.
Identify and investigate suspicious or malicious activity and cyber events that violate TSA policy.
Analyze logs and events from current and future device types that send data to the TSA Security Operations Center.
Review non-traditional data feeds, such as Human Resources data, badging information, and physical security devices, integrated into the SIEM architecture.
Document findings and additional information collected during each security investigation.
Record relevant incident artifacts, such as emails, logs, documents, URLs, and screenshots, in the TSA SOC incident tracking system.
Maintain focus and awareness throughout scheduled working hours and adapt to additional responsibilities or changes to assigned duties.