Network Based Systems Analyst II

Arsiem•Arlington, VA

1d•Onsite

About The Position

ARSIEM Corporation is seeking a Network Forensics Cybersecurity Analyst to support a government client in Arlington, Virginia. The analyst assists the Government lead in coordinating preliminary incident response investigations and interfacing with the customer onsite. The role involves analyzing anomalous and malicious network activity, assessing network topologies and device configurations, collecting intrusion artifacts and network device integrity data, and supporting incident mitigation and remediation. The analyst also helps develop and publish Computer Network Defense guidance and reports findings to appropriate constituencies, and assists with real-time incident handling during onsite engagements.

Requirements

Bachelor's degree in Computer Science, Cyber Security, Computer Engineering, or a related field; alternatively, a high school diploma and 4–6 years of network investigations experience.
At least 2 years of directly relevant experience in network investigations.
In-depth knowledge of Computer Network Defense policies, procedures, and regulations.
In-depth knowledge of TCP/IP and standard protocols, including ICMP, HTTP/S, DNS, SSH, SMTP, SMB, and NFS.
In-depth knowledge and experience of Wi-Fi networking and network topologies such as DMZs and WANs.
Substantial knowledge of Splunk or other SIEMs.
Understanding of MITRE Adversary Tactics, Techniques, and Common Knowledge (ATT&CK).
Knowledge of defense-in-depth principles and general attack stages as they relate to network security architecture.
Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.
Ability to identify and analyze anomalies in network traffic using metadata.
Experience reconstructing malicious attacks or activity based on network traffic.
Experience examining network topologies to understand data flows.
Ability to work collaboratively across physical locations.
Active TS/SCI clearance and ability to obtain Department of Homeland Security Entry on Duty Suitability.

Nice To Haves

Substantial knowledge of network device integrity concepts and methodologies.
Proficiency with network analysis software such as Wireshark.
Proficiency with carving and extracting information from PCAP data.
Proficiency with non-traditional network traffic, such as Command and Control.
Proficiency with preserving evidence integrity according to standard operating procedures or national standards.
Proficiency with designing cybersecurity systems and environments in Linux and/or Windows.
Proficiency with virtualized environments.
DoD 8140.01 IAT Level II, IASAE II, or CSSP Analyst qualification.
DoD 8140.01 GCIA, GCIH, CSSP Analyst, or CSSP Incident Responder qualification.
DoD 8140.01 CEH or CSSP Analyst qualification.
SANS GIAC GNFA certification.

Responsibilities

Assist the Government lead in coordinating teams conducting preliminary incident response investigations.
Assist the Government lead with customer interfacing while onsite.
Determine appropriate courses of action in response to identified and analyzed anomalous network activity.
Assess network topology and device configurations, identify critical security concerns, and provide security best-practice recommendations.
Assist with writing and publishing Computer Network Defense guidance and reports on incident findings to appropriate constituencies.
Collect network intrusion artifacts, such as PCAPs, domains, URIs, and certificates, and use the data to enable mitigation of potential Computer Network Defense incidents.
Analyze malicious network activity to determine exploited weaknesses, exploitation methods, and effects on systems and information.
Collect network device integrity data and analyze it for signs of tampering or compromise.
Assist with real-time Computer Network Defense incident handling, including forensic collections, intrusion correlation and tracking, threat analysis, and advising on system remediation, to support onsite engagements.