Network Based Systems Analyst III

Solutions³ LLC • Arlington, VA

1d • $94,000 - $112,000 • Onsite

About The Position

Solutions³ LLC is supporting a U.S. Government customer with advanced technical assistance, proactive threat hunting, rapid onsite incident response, and investigation and resolution using host-based, network-based, and cloud-based cybersecurity analysis capabilities.

The Network Based Systems Analyst III serves as a Cyber Network Defense Analyst (CNDA), providing frontline digital forensics and incident response (DFIR) and proactively hunting for malicious cyber activity. The analyst monitors network activity using information from a variety of sources, analyzes it for suspicious behavior, and identifies and reports events that have occurred or could occur to help protect information, information systems, and networks.

The role supports the establishment and expansion of a Cyber Threat Intelligence Database across multiple domains. It contributes to improving cybersecurity posture and operational efficiency and works with external partners on a complex Threat Intelligence platform. The position is onsite in Arlington, Virginia, and requires U.S. citizenship, an active TS/SCI clearance, and the ability to obtain DHS Suitability before starting. Salary range is $94,000–$112,000.

Requirements

• At least 5 years of directly relevant experience in network investigations.
• U.S. citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability before starting employment.
• Bachelor’s degree in Computer Science, Cyber Security, Computer Engineering, or a related field; alternatively, a high school diploma and 7+ years of network investigations experience.
• In-depth knowledge of CND policies, procedures, and regulations.
• In-depth knowledge of TCP/IP and standard protocols, including ICMP, HTTP/S, DNS, SSH, SMTP, SMB, and NFS.
• In-depth knowledge and experience with Wi-Fi networking and network topologies such as DMZs and WANs.
• Substantial knowledge of Splunk or other SIEMs.
• Understanding of MITRE ATT&CK.
• Knowledge of defense-in-depth principles and general attack stages with respect to network security architecture.
• Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.
• Ability to identify and analyze network traffic anomalies using metadata.
• Experience reconstructing malicious attacks or activity from network traffic.
• Experience examining network topologies to understand data flows.
• Ability to work collaboratively across physical locations.

Nice To Haves

• Substantial knowledge of network device integrity concepts and methodologies.
• Proficiency with network analysis software such as Wireshark.
• Proficiency with carving and extracting information from PCAP data.
• Proficiency with non-traditional network traffic, such as Command and Control.
• Proficiency in preserving evidence integrity according to standard operating procedures or national standards.
• Proficiency with virtualized environments.
• Desired certifications: DoD 8140.01 IAT Level II, IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Analyst/CSSP Incident Responder, or CEH.
• SANS GIAC GNFA is preferred.

Responsibilities

• Assist the Government lead in coordinating teams conducting preliminary incident response investigations.
• Assist the Government lead with interfacing with the customer onsite.
• Determine appropriate courses of action in response to identified and analyzed anomalous network activity.
• Assess network topology and device configurations, identify critical security concerns, and provide security best-practice recommendations.
• Collect network intrusion artifacts, such as PCAP, domains, URIs, and certificates, and use the data to enable mitigation of potential Computer Network Defense incidents.
• Analyze malicious network activity to determine exploited weaknesses, exploitation methods, and effects on systems and information.
• Collect network device integrity data and analyze it for signs of tampering or compromise.
• Assist with real-time CND incident handling during onsite engagements, including forensic collections, intrusion correlation and tracking, threat analysis, and advising on system remediation.
• Contribute to the creation, maintenance, and expansion of a Cyber Threat Intelligence Database across multiple domains.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level