Intrusion Detection Monitoring and Incident Management Support

POSITION:

Intrusion Detection Monitoring and Incident Management Support

O'Fallon, Illinois, Scott Air Force Base

Secret

Full-time 40 hours per week

The United States Transportation Command (USTRANSCOM) located at Scott Air Force Base (AFB), IL, is one of 11 Unified Combatant Commands (UCC). USTRANSCOM provides command and control (C2) for the synchronized transportation, distribution, and sustainment of personnel and assets, making possible the projection and maintenance of national power wherever needed with speed and agility, high efficiency, and a high level of trust and accuracy.

USTRANSCOM operates the Common Computing Environment (CCE) surrounded by a network defense infrastructure. The USTRANSCOM CCE, supported by TCJ6 and USTRANSCOM Component Commands, is comprised of several operating systems on clients and servers, both physical and virtual. The diversity of applications riding on the USTRANSCOM CCE (C2 systems, information management systems, mail/message systems, and security systems) increases the complexity and difficulty to integrate new system requirements.

The information security infrastructure operating with the USTRANSCOM CCE is a unique integration of products demanding a high degree of technical skills and understanding.

The Intrusion Detection Monitoring and Incident Management support position will execute intrusion detection monitoring and incident response and management processes and procedures IAW DoD and USTRANSCOM policies and direction. This position will provide intrusion detection monitoring, analysis, and incident management activities on-site 24/7/365 at Scott AFB.

BTAS is a woman-owned small business founded in 1995, located near Wright-Patterson Air Force Base in Beavercreek, OH. We have earned national and regional awards in the Department of Defense for our proven IT, Engineering, and Program Management capabilities.

We are committed to working with exceptional quality and professionalism to deliver excellence to our customers, while providing our employees with a stimulating and satisfying work environment as we collaborate with teammates to achieve common goals.

Intrusion detection/analysis/incident management activities will be performed for all USTRANSCOM information systems/networks that subscribe to USTRANSCOM CSSP services. The intrusion detection monitoring and incident management tool suites consists of network and host-based sensors in all security domains and enclaves, log consolidation mechanisms, analysis platforms, and other products that may be directed or procured.

Perform the day-to-day mission execution of the intrusion detection monitoring and incident management and response activity.

• Reviewing audit data, e-mail spam (also known as junk e-mail or unsolicited bulk e-mail), and network traffic data for irregularities or other indications of real or potential security violations.
• Correlating and analyzing security data and events from alert and traffic flow systems [e.g., intrusion detection system/intrusion prevention system (IDS/IPS), routers, Netflow, firewall].
• Identifying potential distributed, long-term, coordinated, low-visibility network-based attacks.
• Reviewing and sharing significant activity via SIGACT reports and Attack Sense and Warning (AS&W) tippers.

Perform the day-to-day operation and maintenance of the intrusion detection monitoring and incident management tool suites.

• Maintain the existing configuration and integrity of the intrusion detection monitoring and incident management tool suite IAW applicable policies and instructions.
• Develop new intrusion detection signatures and modify the signatures at the direction of the Government; report false positive alerts IAW applicable USCYBERCOM/JFHQ DODIN orders.
• Develop and maintain security analysis scripts and analytic displays.
• Operate and maintain a service assurance capability for intrusion detection monitoring and incident management tools.

Collect and provide the Government with monthly metrics on intrusion detection monitoring and incident management activity.

• Uptime statistics based on service availability for intrusion detection monitoring and incident management tools (e.g., network and host-based sensors, log consolidation mechanisms, analysis platforms) based on service assurance monitoring.
• Number and type of cyber incidents by category IAW CJCSI 6510.01F.

Maintain current documentation on intrusion detection monitoring and incident management processes and procedures and provide the deliverable documents to the Government.

• 5+ years of experience with monitoring and identifying vulnerabilities, anomalies, and active threats; looking at the network from an investigative perspective, using Security Information and Event management (SEIM) tools to analyze traffic data
• CompTIA Security+ (ce) certification

• Experience with Splunk or ELK…