Principal Cyber Threat Analyst
About The Position
Northrop Grumman’s Corporate Sector Chief Information & Digital Office (CIDO) is seeking a Principal Cyber Threat Analyst to support the CISO & Global Cybersecurity organization’s Intelligence and Response (I&R) team. The I&R team provides counterintelligence and cyber threat protection for Northrop Grumman intellectual property, networks, and sensitive data. It analyzes current network and host-based threat activity, assesses emerging trends, monitors counterintelligence portals, and works with Defense Industrial Base and government peers to protect the Northrop Grumman Managed Network (NGMN). The analyst will process and mitigate cyber threat activity as part of a cybersecurity and counterintelligence team. Working with I&R team members and Strategic CI analysts, the role helps coordinate threat-mitigation efforts and identify and counter sophisticated cyber threats across the NGMN. The position requires adaptability, self-direction, creativity, mission commitment, and strong written and verbal communication skills. The role uses commercial and custom tools to investigate cyber events, analyze host and network logs, correlate network indicators and PCAP data, conduct forensic analysis of system images, build event timelines, and determine root causes. The analyst prepares written analyses and briefs findings to technical and non-technical audiences, conducts all-source research on cyber threat actors and intrusion sets, and supports informational and analytic products that provide situational awareness and warning of current and emerging threats.
Requirements
- Five years of relevant experience with a Bachelor of Science, three years with a master's degree, or one year with a Ph.D.
- Ability to obtain and maintain a U.S. Government Top Secret security clearance as a condition of continued employment.
- Ability to prepare and analyze data and figures.
- Experience with two or more analysis tools used in a SOC/CIRT or similar investigative environment.
- At least two years of experience analyzing log data in support of intrusion analysis or cybersecurity operations.
- At least four years of experience with Python, PowerShell, or another scripting language.
Nice To Haves
- Current U.S. Government Top Secret security clearance.
- Awareness of current endpoint and network exploits and familiarity with computer network exploitation methodologies and tools.
- Understanding of network communication protocols at all layers of the OSI model.
- Experience working with large data sets, high-performance computing systems, and artificial intelligence tools.
- Experience working with endpoint detection and response technologies.
- Experience with cyber threat intelligence methodologies.
- Linux/Unix and Windows proficiency, including Bash or PowerShell scripting.
- Familiarity with current cybersecurity threats facing U.S. defense contractors or the U.S. Government.
- One or more technical certifications, or equivalents, such as GCED, GCIH, GCIA, GCFA, GREM, or CFCE.
- Other vendor certifications such as EnCE, ACE, CCNA, or CISSP.
Responsibilities
- Use commercial and custom applications, systems, and tools to triage cyber events.
- Analyze host- and network-based logs and correlate network indicators and PCAP data.
- Conduct forensic analysis of system images, generate event timelines, and perform root cause analysis.
- Prepare detailed written analyses of events and brief findings to technical and non-technical audiences.
- Conduct all-source research on cyber threat actors and intrusion sets, and evaluate technical and intelligence reporting about cyber threats.
- Support informational and analytic products that increase situational awareness and provide advanced warning of current and emerging cyber threats and risks.
- Analyze incidents, threats, risks, impacts, consequences, vulnerabilities, tactics, techniques, procedures, and other malicious and non-malicious indicators.
- Collaborate with I&R team members and Strategic CI analysts to coordinate threat-mitigation efforts.
Benefits
- Flexible work arrangements
- Learning opportunities
- Friendly team environment
- Health insurance coverage
- Life and disability insurance
- Savings plan
- Company-paid holidays
- Paid time off for vacation and/or personal business
- 9/80 work schedule
- 401(k) matching program
- Potential overtime, shift differential, and discretionary bonus, depending on the position
- Potential long-term incentives for employees in Vice President or Director positions
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Principal
