Network Forensics Cybersecurity Analyst

Solutions³ LLC • Arlington, VA

3d • $75,000 - $94,000 • Onsite

About The Position

Solutions³ LLC is supporting a U.S. Government customer that provides on- and offsite incident response support to Government agencies and critical infrastructure owners experiencing cyber-attacks. The Network Forensics Cybersecurity Analyst provides advanced technical assistance, proactive threat hunting, rapid onsite incident response, and immediate investigations using host- and network-based cybersecurity analysis capabilities. The analyst investigates breaches to characterize their severity and develop mitigation and remediation plans.

The position is onsite in Arlington, Virginia, with a stated salary range of $75,000–$94,000. Candidates must be U.S. citizens, hold an active TS/SCI clearance, and be able to obtain DHS Suitability before starting employment. The posting requires a bachelor’s degree in a relevant field or a high school diploma and four or more years of network investigations experience.

Requirements

• U.S. citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability before starting employment.
• At least two years of directly relevant experience in network investigations.
• In-depth knowledge of Computer Network Defense policies, procedures, and regulations.
• In-depth knowledge of TCP/IP and standard protocols, including ICMP, HTTP/S, DNS, SSH, SMTP, SMB, and NFS.
• In-depth knowledge and experience of Wi-Fi networking and network topologies such as DMZs and WANs.
• Substantial knowledge of Splunk or other SIEM tools.
• Understanding of MITRE ATT&CK.
• Knowledge of defense-in-depth principles and general attack stages in relation to network security architecture.
• Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.
• Ability to identify and analyze anomalies in network traffic using metadata.
• Experience reconstructing malicious attacks or activity from network traffic.
• Experience examining network topologies to understand data flows.
• Ability to work collaboratively across physical locations.
• Bachelor’s degree in Computer Science, Cybersecurity, Computer Engineering, or a related field; alternatively, a high school diploma and at least four years of network investigations experience.

Nice To Haves

• Substantial knowledge of network device integrity concepts and methodologies.
• Proficiency with network analysis software such as Wireshark.
• Proficiency carving and extracting information from PCAP data.
• Proficiency with non-traditional network traffic, such as Command and Control.
• Proficiency preserving evidence integrity according to standard operating procedures or national standards.
• Proficiency designing cybersecurity systems and environments in Linux and/or Windows.
• Proficiency with virtualized environments.
• DoD 8140.01 IAT Level II, IASAE II, or CSSP Analyst certification.
• DoD 8140.01 GCIA, GCIH, CSSP Analyst, or CSSP Incident Responder certification.
• DoD 8140.01 CEH or CSSP Analyst certification.
• SANS GIAC GNFA certification preferred.

Responsibilities

• Assist the Government lead in coordinating teams conducting preliminary incident response investigations.
• Assist the Government lead with customer interactions while onsite.
• Determine appropriate courses of action in response to identified and analyzed anomalous network activity.
• Assess network topology and device configurations, identify critical security concerns, and provide security best-practice recommendations.
• Assist with writing and publishing Computer Network Defense guidance and reports on incident findings for appropriate constituencies.
• Collect network intrusion artifacts, such as PCAP data, domains, URIs, and certificates, and use discovered data to support mitigation of potential Computer Network Defense incidents.
• Analyze malicious network activity to determine exploited weaknesses, exploitation methods, and effects on systems and information.
• Collect network device integrity data and analyze it for signs of tampering or compromise.
• Assist with real-time Computer Network Defense incident handling for onsite engagements, including forensic collections, intrusion correlation and tracking, threat analysis, and advice on system remediation.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level