Cyber Eviction Analyst

The DHS’s Hunt and Incident Response Team (HIRT) secures the nation’s infrastructure. HIRT provides DHS’s front-line response for cyber incidents and proactive hunting for malicious cyber activity. Nightwing supports on- and offsite incident response for government agencies and critical infrastructure owners who experience cyber‑attacks, providing HIRT advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host and network‑based cybersecurity analysis capabilities.

Personnel investigate incidents to characterize the level of severity and develop mitigation and remediation plans. Nightwing is seeking Cyber Eviction Analysts to support this critical customer mission.

• Serve as hunt and incident response subject matter expert (SME), applying in-depth knowledge on threat actor (TA) tools, techniques, and procedures (TTPs)
• Distill analytic findings into executive summaries and in‑depth technical reports
• Provide expert support, analysis, and research with broad direction into exceptionally complex problems and processes relating to hunt and incident response activities
• Serve as technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives
• Exercise considerable latitude in determining technical objectives of an assignment or task at hand
• Independently develop technical solutions to complex problems that require regular use of ingenuity and creativity
• Analyze incident data and victim environments to recommend targeted mitigations
• Advise technical personnel on countermeasure implementation and customization
• Support internal stakeholders on containment and eradication missions
• Document analysis in a standardized knowledge‑base for sharing and publication
• Assist in maintaining branch process and procedure documentation
• Guide the completion of hunt and incident response activities

• U.S. Citizenship
• Active TS/SCI clearance
• Ability to obtain DHS suitability
• 8+ years of directly relevant experience in the area of expertise
• Ability to travel domestically on short notice
• Strong understanding of network architecture/security
• Experience performing cyber incident response
• Ability to think independently
• Excellent written and oral communication skills
• Capacity to work collaboratively across physical locations
• Skill in identifying different classes of attacks and attack stages
• Understanding of system and application security threats and vulnerabilities
• Understanding of proactive analysis of systems and networks, including creating trust levels of critical resources
• Proficiency with common operating systems (e.g., Linux/Unix, Windows)

• Experience leading and mentoring technical teams
• Knowledge of Computer Network Defense policies, procedures and regulations
• Knowledge of different operational threat environments (e.g., first generation, second generation, third generation)
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross‑site scripting, PL/SQL and injections, race conditions, covert channel, replay, return‑oriented attacks, malicious code)
• Network and system administration experience
• Strong understanding of adversarial tactics, techniques and procedures (TTPs)
• Experience with Identity and Access Management (IAM) tools
• Ability to review and analyze Enterprise Architecture (EA) from a security perspective
• Understanding of cyber defense‑in‑depth principles
• Hands‑on skill in host/network intrusion detection
• Ability to perform event correlation
• Experience with malicious activity analysis
• Ability to collaborate with stakeholders at multiple levels within an organization

BS Computer Science, Cyber Security, Computer Engineering, or related degree; or HS Diploma & 10+ years of technical experience in the area of expertise.

• DoD 8140.01 IAT Level II, IASAE II, CSSP Analyst
• DoD 8140.01 GCIA, GCIH, CSSP Analyst/CSSP Incident Responder
• DoD 8140.01 CEH, CSSP Analyst
• SANS GIAC GNFA preferred
• SANS GRID, GICSP, or GCIP a plus

• Extremely competitive salary
• 95% employer paid for employee medical, dental, & vision coverages
• 100% employer paid for employee life, STD & LTD disability coverages
• 401(k) with company match and profit sharing
• Flexible Spending Account (FSA) for dependent & health care
• 11 standard holidays & 3 weeks of annual leave