Mid Cyber Defense Analyst MDX - SSFB/HSV

Amentum•Colorado Springs, CO

1d•$119,000 - $130,000•Onsite

About The Position

The Mid Cyber Defense Analyst is part of Amentum’s Missile Defense Division and directly supports the Missile Defense Agency. The position performs Defensive Cyber Operations and Cyber Security Service Provider duties in a 24x7x365 operational environment, working rotating shifts at Schriever Space Force Base in Colorado Springs, Colorado, or Redstone Arsenal in Huntsville, Alabama. The role is not available for remote or telework and may require travel. The selected candidate may be assigned as an employee of a teammate company. The analyst conducts proactive and reactive cybersecurity work on customer networks, investigates and responds to cyber incidents, analyzes asset, threat, and vulnerability data, and helps improve enterprise security posture. The role also supports incident documentation and evidence preservation, cyber defense training and mentoring, procedure development, threat-intelligence-driven detection, and coordination with CSSP-CERT subscribers and investigative agencies.

Requirements

At least 2 years of general full-time work experience; this may be reduced with completion of advanced education.
At least 4 years of directly related experience in information security, physical security, cybersecurity, or a combination thereof.
At least 1 year of experience working in a management or leadership role.
Possess at least one of the following certifications: FITSP-O, CEH(P), GMON, GRID, GCED, GDSA, GSEC, PenTest+, CySA+, or Cloud+.
Have an active DoW Secret Security Clearance.
Be able to obtain and maintain an active DoW Top Secret Security Clearance.
Experience with most MS Office applications, including Word, Excel, PowerPoint, and Visio.
Ability to multitask and prioritize projects and assignments in a dynamic work environment to meet scheduled and unscheduled customer requests.
Willingness to work rotating shifts in a 24x7x365 operational environment and respond quickly to emergencies.
Resumes submitted with the application must use month-and-year date formatting.

Nice To Haves

Bachelor’s degree or higher in Cybersecurity, Computer Science, or a related field.
Experience with security analysis and solutions in a WAN/LAN environment, including routers, switches, network devices, and operating systems such as Windows and Linux.
Experience with SOC/DCO tools and applications such as firewalls, intrusion detection/prevention systems, Network Security Manager, forward proxy, and spam firewall.
Experience analyzing security compliance scans across a WAN; ACAS/Nessus experience preferred.
Experience analyzing network and host-based threats; ESS experience preferred.
Ability to mentor and train personnel in an evolving, high-paced environment.
Familiarity with DoD Security Operations Centers.
Familiarity with DCO/Cybersecurity Service Provider (CSSP) guiding security policies and procedures.
Active DoD Top Secret clearance.
Willingness to travel up to 25% of the time.

Responsibilities

Perform Defensive Cyber Operations (DCO) and Cyber Security Service Provider (CSSP) duties outlined in Evaluator Scoring Metrics (ESM).
Perform proactive and reactive cybersecurity duties on customer networks to improve enterprise-wide security posture.
Conduct preliminary analysis, identification, and response actions to detect, characterize, and respond to cyber incidents in accordance with CJCSM 6510.01B.
Lead event and incident investigations from start to conclusion, including data gathering, analysis, and reporting.
Document incident response steps and preserve and protect incident artifacts, evidence, and chain of custody.
Analyze correlated asset, threat, and vulnerability data against known adversary exploits and techniques to assess impact and improve network defensive posture.
Support cyber defense analyst and incident responder training by instructing, evaluating, and mentoring junior personnel.
Support development, establishment, review, and updates of DCO procedures, processes, manuals, and other documentation.
Use actionable Cyber Threat Intelligence to search for indicators of compromise, develop SIEM content and signatures to detect known attack patterns, and recommend improvements.
Coordinate with CSSP-CERT subscribers to develop current configurations, rules, and signatures for cybersecurity toolsets.
Coordinate with CSSP-CERT subscribers to notify, investigate, and remediate security logging and CSSP-CERT alignment discrepancies.
Provide standardized and targeted training for CSSP-CERT subscriber cyber defense and incident response programs.
Review ongoing intrusion and cybersecurity incident data, and report, analyze, and document findings in accordance with CJCSM 6510.01B guidelines.
Support internal and external Insider Threat and law enforcement/counterintelligence agencies during cyber incidents and investigations.
Work rotating shifts in a 24x7x365 operational environment and respond quickly to emergencies as needed.