Insider Threat Monitoring Analyst

Overview

The Department of Homeland Security (DHS), Customs and Border Protection (CBP) Cyber Security Directorate (CSD) Security Operations Center (SOC) is a US Government program responsible for preventing, identifying, containing, and eradicating cyber threats to CBP networks through monitoring, intrusion detection, and protective security services. The CBP SOC secures CBP Enterprise-wide information systems (LAN/WAN, cloud, mobile, wireless, websites, and devices) and collects, investigates, and reports suspected and confirmed security violations.

Leidos is seeking an experienced Insider Threat Expert to join our team to lead user activity monitoring, FSN monitoring, insider threat analysis, and investigations of policy violations, data loss prevention (DLP) events, and sensitive data spillages in support of CBP.

• Lead investigations and support for insider threat and forensics activities, including near real-time monitoring of DLP tools for potential data exfiltration of CBP mission data or employee PII/SPII.
• Support investigations with the Office of Professional Responsibility (OPR), Office of Intelligence (OI), Office of the Inspector General (OIG), and other government agencies when CBP personnel may be malicious or have alleged criminal intent.
• Actively monitor Foreign Service National (FSN) network activity for misuse and policy violations.
• Support User Activity Monitoring (UAM) activities.
• Recommend insider threat alert triggers and detections across various security tools and logging sources.
• Monitor CBP laptops and mobile devices traveling OCONUS for suspicious activity and policy violations.
• Provide investigative support for CBP’s OPR-Cyber Investigations related to media leak investigations by identifying all users who accessed, sent, printed, copied, downloaded/uploaded, or received leaked documents.
• Provide recommendations for Information Spillage Incident Response, following industry best practices, NIST 800-88, and federal guidelines.

• BS degree with a minimum of 8 years of directly relevant experience.
• Active and current CISSP certification.
• Degree in computer science, IT, Information/Cyber Security from an accredited college or university; additional experience or applicable certifications may be accepted in lieu of a degree.
• Working knowledge of defense-in-depth principles, security architecture (network/HW/SW), IT device integrity, and common security elements.
• Effective communication skills with attention to detail, ability to document technical remediation details, and ability to brief stakeholders on incident statuses, recovery, and root causes.
• Experience performing forensic and digital media analysis, and in-depth system and network log analysis to support investigations.
• Ability to generate forensically sound cyber analysis reports detailing procedures, findings, and recommendations.
• Strong problem-solving abilities with analytical reasoning under pressure.
• Experience with User Activity Monitoring products and platforms.
• Experience with Endpoint Detection and Response (EDR) tools.
• Ability to report to the Ashburn, VA office up to 5 days per week.
• U.S. citizenship is required.
• Active Top Secret clearance and ability to obtain and maintain a CBP BI clearance.

• Master’s degree in IT Management, Engineering, or a related field.
• SANS GREM certification.
• Experience contributing to or leading insider threat investigations in Federal Government, DOD, or Law Enforcement environments.
• Experience performing computer forensics in Federal Government, DOD, or Law Enforcement environments.

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, disability, genetic information, pregnancy, family structure, marital status, or any other Basis prohibited by law. Leidos will also consider qualified applicants with criminal histories consistent with relevant laws.