Network Based Systems Analyst II

ARSIEM • Arlington, VA

1d

About The Position

ARSIEM Corporation is seeking a Network Forensics Cybersecurity Analyst to support a Government client in Arlington, Virginia. The role assists the Government lead in coordinating preliminary incident response investigations, interfacing with the customer onsite, and supporting real-time Computer Network Defense incident handling. The analyst evaluates anomalous network activity, network topologies, and device configurations; collects and analyzes network intrusion artifacts and device integrity data; and contributes to incident guidance and reports. The position requires an active TS/SCI clearance and the ability to obtain Department of Homeland Security Entry on Duty Suitability.

Requirements

• Bachelor's degree in Computer Science, Cyber Security, Computer Engineering, or a related field; alternatively, a high school diploma and 4–6 years of network investigations experience.
• At least 2 years of directly relevant experience in network investigations.
• In-depth knowledge of Computer Network Defense policies, procedures, and regulations.
• In-depth knowledge of TCP/IP protocols and standard protocols including ICMP, HTTP/S, DNS, SSH, SMTP, SMB, and NFS.
• In-depth knowledge and experience with Wi-Fi networking and network topologies such as DMZs and WANs.
• Substantial knowledge of Splunk or other SIEMs.
• Understanding of MITRE Adversary Tactics, Techniques, and Common Knowledge (ATT&CK).
• Knowledge of defense-in-depth principles and general attack stages with respect to network security architecture.
• Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.
• Ability to identify and analyze anomalies in network traffic using metadata.
• Experience reconstructing a malicious attack or activity based on network traffic.
• Experience examining network topologies to understand data flows through the network.
• Ability to work collaboratively across physical locations.
• Active TS/SCI clearance and ability to obtain Department of Homeland Security Entry on Duty Suitability.

Nice To Haves

• Substantial knowledge of network device integrity concepts and methodologies.
• Proficiency with network analysis software such as Wireshark.
• Proficiency with carving and extracting information from PCAP data.
• Proficiency with non-traditional network traffic, such as Command and Control.
• Proficiency with preserving evidence integrity according to standard operating procedures or national standards.
• Proficiency with designing cybersecurity systems and environments in Linux and/or Windows environments.
• Proficiency with virtualized environments.
• DoD 8140.01 IAT Level II, IASAE II, or CSSP Analyst certification.
• DoD 8140.01 GCIA, GCIH, CSSP Analyst, or CSSP Incident Responder certification.
• DoD 8140.01 CEH or CSSP Analyst certification.
• SANS GIAC GNFA certification preferred.

Responsibilities

• Assist the Government lead in coordinating teams conducting preliminary incident response investigations.
• Assist the Government lead with customer interfacing while onsite.
• Determine appropriate courses of action in response to identified and analyzed anomalous network activity.
• Assess network topology and device configurations, identify critical security concerns, and provide security best-practice recommendations.
• Assist with writing and publishing Computer Network Defense guidance and reports on incident findings for appropriate constituencies.
• Collect network intrusion artifacts, such as PCAP, domains, URIs, and certificates, and use discovered data to support mitigation of potential Computer Network Defense incidents.
• Analyze identified malicious network activity to determine exploited weaknesses, exploitation methods, and effects on systems and information.
• Collect network device integrity data and analyze it for signs of tampering or compromise.
• Assist with real-time Computer Network Defense incident handling, including forensic collections, intrusion correlation and tracking, threat analysis, and advising on system remediation, to support onsite engagements.

Benefits

• A $3,500 candidate referral bonus may be earned for a new candidate who is successfully placed on a project; it is paid after the referred employee reaches six months of employment.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level