Red Team Cyber Analyst

Amentum•Fort Belvoir, VA

1d•$100,000 - $130,000

About The Position

Red Team Cyber Analysts provide strategic and tactical analytic support to the DoD Red Team, shaping cyber operations by selecting cyber targets and identifying cyber-enabling actions from an adversary perspective. They manage, communicate, and present information to team members, partner organizations, customers, and external parties, and are expected to show initiative, creativity, analytical independence, professionalism, and respect. The role provides advisory support in computer, network, and infrastructure analysis to enable adversarial cyber and/or electronic warfare operations. Analysts serve as subject matter experts on complex cyber threats and may travel domestically and internationally to support geographically dispersed vulnerability assessments. They research potential adversary positions, access points, relationships, organizations, and vulnerabilities; identify cyber information and architecture gaps; and develop courses of action for vulnerability assessments. They advise tactical partner elements and Red Team personnel, provide specialized training, apply advanced analytic skills and tools, and maintain knowledge of industry practices related to cyber red teaming. The position reports directly to the Red Team Cyber Analysis Lead. Red Team Cyber Analysts are not authorized to conduct cyber or ground operations; they provide the analytic support that enables operations. Candidates must have strong analytical skills, a DoD IAT Level II certification or higher, and conceptual knowledge of cyber-related programs and software such as Metasploit, Nessus, and Wireshark. An active TS/SCI clearance is required.

Requirements

DoD IAT Level II certification or higher demonstrating knowledge of information security principles relating to DoD network administration and the cyber domain.
Active TS/SCI clearance.
Strong analytical skills and the ability to think critically and emulate threat actors’ actions.
Ability to communicate complex information, concepts, or ideas confidently and clearly through verbal, written, and visual means.
Ability to accurately and completely source data used in analytic products.
Ability to formulate research questions from information requirements.
Ability to develop or recommend analytic approaches or solutions when information is incomplete or no precedent exists.
Ability to evaluate, analyze, and synthesize large quantities of potentially fragmented or contradictory data into high-quality products.
Ability to focus research on customers’ decision-making needs and identify information gaps.
Ability to function effectively in a dynamic, fast-paced environment and collaborative setting, consulting with analysts and experts to leverage expertise.
Ability to recognize and mitigate cognitive biases that may affect analysis.
Understanding of physical and digital aspects of communications systems.
Proficiency in understanding, analyzing, and summarizing complex technical, contractual, and research information or data.
Demonstrated expertise in information and data collection, analysis, and fusion.
Current driver’s license and ability to operate a rental vehicle.
Conceptual knowledge of cyber-related programs and software, such as Metasploit, Nessus, and Wireshark.

Nice To Haves

Knowledge of common computer and network infections, including viruses and Trojans, and infection methods.
Knowledge of computer networking fundamentals and network components and types.
Knowledge of communications media and their terminology and operations, including computer and telephone networks, satellite, fiber, and wireless.
Knowledge of cyber operations terminology and lexicon.
Knowledge of data communications terminology, including networking protocols, Ethernet, IP, encryption, optical devices, and removable media.
Knowledge of how to extract, analyze, and use metadata.
Knowledge of intelligence disciplines, intelligence preparation of the environment, and intelligence support to planning, execution, and assessment.
Knowledge of tactics used to anticipate or emulate threat capabilities and actions.
Knowledge of Internet network addressing, including IP addresses, CIDR, and TCP/UDP port numbering.
Knowledge of malware, operations security, organizational hierarchy, and cyber decision-making processes.
Knowledge of physical and logical network devices and infrastructure, including hubs, switches, routers, and firewalls.
Knowledge of telecommunications fundamentals and modern communications network structure, architecture, and design.
Knowledge of network security concepts, including encryption, firewalls, authentication, honeypots, and perimeter protection.
Knowledge of common networking and routing protocols, services such as web, mail, and DNS, and how they interact to provide network communications.
Knowledge of how targets or threats use the Internet and of threat or target systems.
Knowledge of virtualization products such as VMware and Virtual PC.
Knowledge of what constitutes a network threat.
Understanding of common cyber threat terminology, vulnerability and penetration testing principles and methodologies, and basic cyber incident response forensics and current events.
Familiarity with log analysis, packet analysis, the OSI model, network architectures, NIST, DIA-CAP, RMF, information operations, threat intelligence collection and threat actor tracking, digital forensics and incident response, and threat hunting methodologies.
Experience performing attack analysis or Red Team penetration testing against operational computer networks, including experience in Windows, network, Linux/Unix, database, or mainframe security.

Responsibilities

Characterize adversary cyber capabilities by researching adversarial cyber organizations’ structure, ideology, intentions, tactics, and capabilities using classified and unclassified sources.
Contribute to cyber threat emulation by identifying information requirements, developing assessment strategies, assisting with collection plans, identifying information sources, and researching publicly available information.
Identify, map, and plan potential exploitation of key telecommunications networks.
Analyze and characterize cyber systems, identifying essential functions, tasks, and critical assets relevant to the program.
Develop cyber adversary courses of action against customer personnel, equipment, facilities, networks, information systems, infrastructure, and supply chains; identify critical nodes, links, targets, and relevant environmental factors.
Facilitate timely information management and information flow among DoD Red Team partner elements and other supporting entities.
Support field assessments from a cyber adversary perspective.
Synthesize findings to support vulnerability identification, courses of action, protection studies, trend analyses, risk analyses, and mitigation strategies.
Assess the cyber implications of discovered vulnerabilities, fuse findings with systems analysis, and determine impacts on national and military missions.
Prepare activity reports and deliverables, including out briefs, senior leader briefs, interim progress reports, white papers, after-action reviews, final reports, risk analysis products, and other communications for customers and stakeholders.
Explain network and system mechanisms to analysts and ground elements to facilitate analysis and operations.
Maintain a diverse understanding of network and information security operations, network exploitation, and telecommunications.
Update existing documents to reflect changes in the threat landscape or newly discovered threat tactics and procedures.
Provide strategic and tactical analytic support to DoD Red Team operations and communicate findings to team members, partners, customers, and external parties.
Provide advisory support and subject matter expertise on computer, network, infrastructure, and cyber threat analysis.
Travel domestically and abroad as required to support geographically dispersed vulnerability assessments.
Provide advice to tactical partner elements and Red Team personnel in planning adversarial cyber assessments.
Implement specialized training and use advanced analytic skills and tools while maintaining knowledge of cyber red teaming practices.