Subject Matter Expert

Nightwing Intelligence Solutions•Sterling, VA

About The Position

Nightwing is seeking a Subject Matter Expert to support the DHS Hunt and Incident Response Team (HIRT), which provides front-line cyber incident response and proactive hunting for malicious cyber activity. The role supports government agencies and critical infrastructure owners through onsite and remote investigations, technical assistance, and cybersecurity analysis. The position calls for deep expertise in one or more enterprise edge-device technologies, particularly Cisco, Ivanti, Palo Alto, Ciena, or Juniper. The SME provides technical leadership for network-centric hunt and incident response. This includes analyzing network traffic, device logs, configurations, and telemetry; reconstructing intrusions; assessing network architecture and device integrity; and recommending containment, remediation, and hardening measures. The SME also supports the evaluation and integration of new network forensic and monitoring capabilities, coordinates with government leads and customers, and communicates findings to technical teams and leadership. The role includes preserving evidence, preparing incident guidance and reports, documenting procedures and threat actor techniques, and supporting process documentation. The position requires a bachelor’s degree in a relevant field or a high school diploma/GED with 22 or more years of technical experience in the area of expertise. The stated salary range is $122,000–$253,000, commensurate with qualifications, experience, and expertise. Nightwing offers medical, vision, and dental insurance, a 401(k) plan, PTO, holidays, and additional insurance coverage.

Requirements

U.S. citizenship.
Active TS/SCI clearance.
Ability to obtain DHS Suitability.
At least 10 years of directly relevant experience.
At least 3 years of experience evaluating and implementing new cyber response or network forensic capabilities.
Hands-on incident response or network operations experience involving enterprise edge devices from at least two of these vendors: Cisco, Ivanti, Palo Alto, Ciena, or Juniper.
Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense-in-depth.
Knowledge of Computer Network Defense policies, procedures, and regulations relevant to U.S. government or similar environments.
Ability to characterize and analyze network traffic to identify anomalous activity and potential threats.
Ability to identify and analyze network-traffic anomalies using metadata such as flow, DNS, and proxy data.
Ability to reconstruct malicious activity using network traffic and device logs.
Understanding of general attack stages and how they manifest across networks.
Understanding of system and application security threats and vulnerabilities and how they appear in network traffic.
Understanding of proactive analysis of systems and networks, including establishing trust levels for critical resources and detecting anomalous behavior.
Proficiency with common operating systems such as Linux/Unix and Windows.
Experience performing cyber incident response, including scoping, containment, eradication, and recovery, in operational environments.
Ability to think independently, make sound decisions under pressure, and work with limited guidance.
Superior written and oral communication skills, including explaining technical issues to technical and non-technical stakeholders.
Ability to collaborate across physical locations and within distributed teams.
Skill in identifying attack classes and stages and translating findings into actionable recommendations.
Bachelor’s degree in Computer Science, Cyber Security, Computer Engineering, or a related field; alternatively, a high school diploma/GED and 22 or more years of technical experience in the area of expertise.

Nice To Haves

Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
Network and system administration experience in large or complex enterprise or service-provider environments.
Strong understanding of adversarial TTPs, including MITRE ATT&CK, and varied operational threat environments.
Knowledge of defense-in-depth and zero trust principles and their application to network and edge-device architectures.
Knowledge of system and application security threats and vulnerabilities, including buffer overflow, mobile code, cross-site scripting, injections, race conditions, covert channels, replay, ROP, and malicious code.
Knowledge of network device integrity verification and monitoring approaches.
Hands-on skill in host/network intrusion detection and event correlation across telemetry sources such as firewalls, IDS/IPS, endpoint tools, and SIEM.
Experience analyzing malicious activity, including network beaconing, command and control, and data-exfiltration detection.
Experience with Identity and Access Management tools and their integration into network and edge security architectures.
Ability to review Enterprise Architecture from a security perspective and recommend architecture-level improvements.
Ability to collaborate with stakeholders at multiple organizational levels, including technical staff, management, and senior leadership.
Field diagnostics and cyber forensics skills, including using preloaded analysis stacks, protocol parsers such as Modbus, DNP3, and OPC UA, vulnerability scanning, and local packet capture at line rate.
Experience packing, securing, and transporting ruggedized cases such as Pelican or Nanuk within standard weight and carry-on or air-transport limits.
One or more of the following certifications: IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder, CEH, SANS GIAC GCIA, or GNFA; SANS GRID, GICSP, or GCIP are additional pluses.
Vendor or network certifications, highly desired: Cisco CCNA or higher, including CCNP Security or CCNP Enterprise; vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti, such as PCNSE or JNCIS/JNCIP.

Responsibilities

Serve as a hunt and incident response subject matter expert, applying knowledge of threat actor tools, techniques, and procedures, especially network-centric and edge-device compromises.
Support a technology insertion team by evaluating and integrating new network forensic and monitoring capabilities.
Assist the Government lead in coordinating preliminary incident response investigations, including onsite and remote engagements.
Interface with customers onsite and communicate incident status, findings, and recommendations.
Analyze network traffic, including PCAP, flow data, device logs, DNS logs, and proxy logs, to identify anomalous activity and potential threats.
Reconstruct malicious activity from network traffic and device logs, including timelines, attacker paths, and data-exfiltration patterns.
Examine network topologies, data flows, trust boundaries, and potential choke points to inform hunt and response activities.
Assess network topologies and device configurations and recommend security best practices, particularly for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
Determine appropriate responses to anomalous activity, including containment, eradication, and hardening actions.
Apply defense-in-depth principles and knowledge of attack stages to evaluate and improve network security architecture and edge-device configurations.
Validate network device integrity, detect unauthorized modifications, and recommend remediation.
Lead analysis of logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote-access appliances to identify, scope, and reconstruct intrusions.
Provide expert analysis and research on complex hunt and incident response problems, with broad direction.
Provide technical direction, interpretation, and alternatives to high-level incident response teams handling network-centric incidents.
Independently develop technical solutions to complex problems and exercise latitude in determining technical objectives.
Analyze incident data and victim environments and recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
Advise technical personnel on implementing and customizing countermeasures such as firewall rules, IPS signatures, and access control lists.
Support onsite and remote containment and eradication missions with internal stakeholders.
Preserve evidence integrity in accordance with standard operating procedures or national standards when collecting network data, device artifacts, and logs.
Assist with writing and publishing Computer Network Defense guidance and detailed incident reports for appropriate audiences.
Produce executive summaries and in-depth technical reports for leadership and technical audiences.
Document analyses, TTPs, and device-specific incident-handling procedures in a standardized knowledge base.
Help maintain branch process and procedure documentation and guide completion of hunt and incident response activities.
Quickly configure network TAPs, packet brokers, SPAN ports, and managed or unmanaged switches without disrupting live production or air-gapped traffic.
Run preloaded analysis stacks, protocol parsers, vulnerability scans, and local packet capture at line rate as part of field diagnostics.
Pack, secure, and transport ruggedized cases within standard weight and carry-on or air-transport limits.