Mitigation and Response - Technical

DHS Headquarters • Chandler, AZ

5d

About The Position

The Department of Homeland Security is recruiting for its Mitigation and Response Talent Pool within the DHS Cybersecurity Service Technical Career Track. The pool may be used to consider qualified applicants for a range of technical roles, including Cyber Defense Incident Responder, Cyber Incident Response Analyst, and Cyber Intrusion Detection Specialist, across DHS components and programs. Applicants who complete the multi-phase assessment process may remain eligible for consideration for relevant openings for up to one year after completing the assessment.

Depending on career level and role, employees apply technical expertise to monitor and analyze networks and systems, detect and respond to cyber threats, manage incidents, support recovery, and communicate findings and recommendations to DHS leadership, components, and external stakeholders. The work may include incident handling, threat assessment, digital evidence analysis, security tool operations, and coordination with internal and external partners.

Requirements

• Must be a U.S. citizen or national.
• Must be at least 18 years old.
• Must be registered for the Selective Service if male.
• Must be able to obtain and maintain a security clearance; clearance levels may vary.
• Must be able to submit to a drug test and receive a negative result.
• Must comply with ethics and standards-of-conduct requirements, including completing applicable financial disclosures.
• May be required to serve a three-year probationary period.
• Generally, candidates have 5–15 years of cybersecurity work experience.
• Technical cybersecurity experience and expertise appropriate to the career level, ranging from experienced professionals applying independent judgment to recognized federal technical authorities with uncommon expertise.

Responsibilities

• Support teams and programs in monitoring, analysis, incident response, and incident handling for DHS or its constituents.
• Analyze network traffic patterns and logs from hosts, networks, firewalls, and intrusion detection systems to identify possible threats, using analytic tools and data science methodologies.
• Monitor DHS environments for potential threats or vulnerabilities and provide leadership with situational visibility across the enterprise.
• Create threat assessments for network, software, and hardware vulnerabilities and recommend appropriate mitigation.
• Manage incidents according to NIST incident-handling stages and help less-experienced colleagues apply those standards.
• Tailor communications to different leadership levels and audiences to provide strategic direction and support to DHS, component leadership, security operations centers, and external constituents.
• Collaborate with DHS stakeholders and external partners on security operations and incident handling.
• Work with headquarters and component network or security operations centers to block hostile sites or restrict access by ports or protocols.
• Implement, configure, monitor, and maintain SIEM tools for monitoring, detecting, and responding to threats on DHS or partner networks and enclaves.
• Gather, recover, analyze, interpret, preserve, and present digital information and evidence from computers, mobile devices, websites, and network packets for legal or departmental purposes.
• Incorporate stakeholder feedback into recovery action plans, including interim vulnerability and deficiency mitigation strategies.
• Prepare incident updates and after-action reports that emphasize critical information and address the needs of their audiences.
• Propose and maintain cybersecurity tools, including SIEM and endpoint security tools.
• Coordinate with managers, incident responders, and cybersecurity service provider teams to handle suspected incidents and communicate event history, status, and potential impact in accordance with response plans.
• Collect intrusion artifacts, such as source code, malware, and trojans, and use findings to support mitigation in accordance with recovery action plans.
• Track and respond to prioritized urgent IT and cyber events and indicators of compromise.
• Investigate and analyze response activities and apply advanced response and recovery approaches.
• Identify adversary tactics, techniques, and procedures and apply corresponding defensive controls.
• Conduct root cause analysis and response coordination, recommend mitigation, and execute or adapt recovery action plans.

Benefits

• Federal employment benefits are available to support employees’ professional and personal lives; specific benefits are provided during the application process.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed