Analyst Jobs

About The Position

Requirements

• Bachelor’s degree in Computer Science, Engineering, Information Technology, Cyber Security, or a related field and 12–15 years of related experience; additional years of experience and/or cyber certifications may be considered in lieu of a degree.
• In-depth knowledge of each phase of the incident response lifecycle.
• Expertise in Windows and Linux operating systems, operations, and artifacts.
• Expertise in enterprise network architectures, including routing and switching, common protocols such as DHCP, DNS, and HTTP, and devices such as firewalls, proxies, load balancers, and VPNs.
• Ability to recognize suspicious activity and events, identify common attacker tactics, techniques, and procedures, and perform logical analysis and research to determine incident root cause and scope.
• Expertise with the Cyber Kill Chain and experience using the ATT&CK Framework.
• Scripting experience with Python, PowerShell, and/or Bash.
• Ability to independently prioritize and complete multiple tasks with little to no supervision.
• Flexible, adaptable self-starter with strong relationship-building skills.
• Strong problem-solving abilities and an analytical, qualitative approach to reasoning.
• Strong verbal and written communication skills, including the ability to communicate with subordinates, peers, and leadership.
• Hands-on technical experience in incident detection and response, malware analysis, or computer forensics.
• Must favorably pass a five-year DHS background investigation.
• At least one of the following certifications: SANS GIAC GCIH, GCIA, GCFA, GPEN, GCFE, or GREM; CISSP; OSCP; OSCE; or OSWP.

Nice To Haves

• Experience in cyber government and/or federal law enforcement FISMA systems.

Responsibilities

• Coordinate investigation and response efforts throughout the Incident Response lifecycle.
• Correlate and analyze events and data to determine the scope of cyber incidents.
• Acquire and analyze endpoint and network artifacts, volatile memory, malicious files and binaries, and scripts.
• Recognize attacker tactics, techniques, and procedures as potential indicators of compromise to improve monitoring, analysis, and incident response.
• Develop, document, and maintain incident response processes, procedures, workflows, and playbooks.
• Tune and maintain security tools, including EDR, IDS, and SIEM, to reduce false positives and improve SOC detection capabilities.
• Document investigation and incident response actions in case management systems and prepare formal incident reports.
• Create metrics and determine key performance indicators to drive the maturity of SOC operations.
• Develop security content such as scripts, signatures, and alerts.