Network Defense and Analysis Shift Lead

CACI•San Antonio, TX

2d•Onsite

About The Position

CACI has an exciting and immediate opportunity for a Cybersecurity – Network Defense and Analysis Shift Lead to support the USAF Network Operations Security Center (NOSC). This position works on-site at Lackland Air Force Base in San Antonio, Texas. This is a shift work position in a work center providing 24x7x365 support

Requirements

DoD Top Secret/SCI Security Clearance
B.S. in related field, and 5 or more years’ relevant IT experience; OR 7 or more years’ relevant IT experience.
Must possess experience and demonstrate an understanding of Microsoft server installation, roles, active directory, storage, performance management, and maintenance.
Certified Ethical Hacker (CEH) certification.
CCNA or CompTIA Network+ CE certification.
ITIL Foundation certification within 60 days of start date.

Nice To Haves

Extensive knowledge of network firewalls, computer and server log analysis, computer network servers and analysis of their logs; and digital evidence collection, handling, and security.
Extensive knowledge and experience with network packet capture and analysis software such as WireShark (Ethereal) and Snort.
Experience with standard DoD network topology and DMZ boundary protection; DoD/AF incident reporting processes; Familiarity with NSA Threat Operations Center (NTOC) Attack, Sensing & Warning (AS&W) alerts and processing; knowledge and experience processing Information Assurance Vulnerability Alert (IAVA) notices.

Responsibilities

Lead, manage, and mentor a team of network defense and security analysts reporting to you operationally and administratively; address analytical, technical, and non-technical escalations from analysts on shift; provide input on site staffing matters.
Utilize established training materials and processes to help train analysts assigned to shift; recommend improvements to analytical, operational, and training processes and procedures as necessary.
Provide site-specific and service-level intrusion packet level analysis using selected tools and activities related to mission execution.
Perform cyber incident handling and support activities, including but not limited to incident reporting, notification, documentation, and coordination; detection of events; preliminary analysis and identification; preliminary response actions; incident analysis; response and recovery; and post incident analysis IAW applicable policy and directives.
Maintain IDS/IPS devices to ensure they are operating at optimal efficiency, including, but not limited to assisting in the installation, configuration, maintenance, and management of IDS/IPS sensors; assist in the development and documentation of sensor processes and checklists; and provide technical advice and assistance to resolve network issues.
Perform network event correlation and advanced traffic analysis, vulnerability analysis, IDS/IPS sensor maintenance, IDS/IPS database & VPN technical support, network defense training, support Standardization & Evaluation (Stan/Eval) activities, perform operational process tracking and processing; provide systems and exercise planning support, and prepare network defense technical reports.
Provide oral and written briefs, presentations, and professional reports to government senior leaders and decision makers.