Junior Security Analyst - SECRET CLEARANCE REQUIRED

DirectViz Solutions•Herndon, VA

2d•Onsite

About The Position

DirectViz Solutions (DVS) is seeking a Junior Security Analyst to support the Transportation Security Administration (TSA) Security Operations Center (SOC). The role monitors and analyzes security events and alerts in a 24x7x365 environment, investigates suspicious or malicious activity, and documents findings and evidence in the SOC incident tracking system. The work location is onsite in Herndon, Virginia, and an active Secret clearance or higher is required. The role follows one of two overnight schedules: Sunday through Tuesday, 6:00 PM to 6:00 AM, or Thursday through Saturday, 6:00 PM to 6:00 AM. Personnel rotate every other Wednesday for an 8-hour shift, totaling 80 hours over two weeks. DVS describes itself as a government contractor delivering IT solutions to government clients. The company offers competitive compensation, medical benefits, a 401(k) match, PTO accrual, professional development reimbursement, company-funded technology certifications, and employee recognition programs.

Requirements

High school degree.
One to three years of experience working in a SOC or NOC environment performing security event monitoring and analysis.
Active Secret clearance or higher.
Working knowledge of operating systems commonly deployed in enterprise networks, such as Windows, OS X, and Linux.
Working knowledge of network communications and routing protocols, such as TCP, UDP, ICMP, BGP, and MPLS, and common internet applications and standards, such as SMTP, DNS, DHCP, SQL, HTTP, and HTTPS.
Ability to analyze security logs and events from devices and systems including firewalls, IDS/IPS, HIDS/HIPS, proxy and web filters, vulnerability scans, routers, NetFlow systems, VPN gateways, server event logs, email and host antivirus, desktop security agents, antivirus servers, DNS and DHCP services, network address translation devices, mobile device management systems, PKI, and cloud security infrastructure.
Willingness to work the stated overnight shift schedule, including rotating every other Wednesday.
Ability to maintain focus and awareness throughout scheduled working hours.
Ability to perform tasks involving prolonged sitting or standing at a desk and using a computer, mouse, and keyboard.
Ability to lift and move objects weighing up to 15 pounds as needed.
Excellent verbal and written communication skills and a strong command of English.
Ability to work independently and collaborate effectively as part of a team.
Ability to quickly learn and retain routine tasks and processes.
Strong organizational skills, attention to detail, business correspondence proficiency, and self-management capabilities.
Ability to perform the essential functions of the role satisfactorily and adapt to additional responsibilities or changes to assigned duties.

Nice To Haves

Security+, GIAC Security Essentials (GSEC), or equivalent certification.
Experience with Splunk query language.
Experience with IDS/IPS, firewall, or security configurations and signature development.
Experience with PCAP analysis.
Experience with Tanium threat response.
Experience analyzing IT security events to distinguish legitimate security incidents from non-incidents, including identifying malicious code and malicious activity on systems or enterprise networks.
Experience with a ticket management system for collecting, documenting, and maintaining information about security investigations and incidents.
Experience producing clear and thorough security incident reports and briefings.
Conceptual understanding of Windows Active Directory.
Experience with event logging systems and security event log analysis.
Experience with SIEM platforms that perform log collection, analysis, correlation, and alerting.
Experience identifying and implementing countermeasures or mitigating controls in an enterprise network environment.
Experience collecting and maintaining security investigation and incident information in a format that supports analysis, situational awareness reporting, and law enforcement investigations.

Responsibilities

Monitor and analyze security events and alerts reported by the TSA SIEM system on a 24x7x365 basis.
Identify and investigate suspicious or malicious activity and cyber events that violate TSA policy.
Analyze logs and events from current and future device types sending data to the TSA SOC.
Review non-traditional data feeds, including Human Resources data, badging information, and physical security devices, integrated into the SIEM architecture.
Document findings and additional information collected during each security investigation.
Record relevant artifacts associated with security events and incidents in the TSA SOC incident tracking system.
Monitor the operational status of monitoring components and escalate and report outages of those components.
Collect, document, and maintain information pertinent to security investigations and incidents.