CIRT Tier 2 Analyst

Required

• Bachelor's degree and at least 2 years of experience or a High School diploma and 6 years of experience.
• Must possess or be able to obtain at least one of the following certifications before start date. Continued certification required as a condition of employment:
  • CCNA-Security
    
    CNDCySA+ GICSPGSECSecurity+ CESSCP
• Continued certification is required as a condition of employment.
• Demonstrated experience in the Incident Response lifecycle.
• Knowledge of SOAR ticketing and automated response systems (e.g. Service Now, Splunk SOAR, Microsoft Sentinel).
• Demonstrated experience with using Security Information and Event Management (SIEM) platforms (e.g. Splunk, Microsoft Sentinel, Elastic, Q-Radar).
• Demonstrated experience in using Endpoint Detection and Response systems (e.g. MDE, Elastic
  
  XDR, Carbon Black, Crowdstrike).
• Knowledge of cloud security monitoring and incident response.
• Knowledge of integrating IOCs and Advanced Persistent Threat actors.
• Ability to analyze cyber threat intelligence reporting and understanding adversary methodologies and techniques.
• Knowledge of malware analysis techniques.
• Knowledge of the MITRE ATT&CK and D3
  
  FEND frameworks.
• U.S. Citizenship required.
• Active Secret security clearance required in order to start.

• Proficiency with Splunk for security monitoring, alert creation, and threat hunting.
• Knowledge of Microsoft Azure access and identity management.
• Proficiency with Microsoft Defender for Endpoint and Identity for security monitoring, response, and alert generations.
• Experience in using digital forensics collection and analysis tools (e.g. Autopsy, Magnet Forensics, Zimmerman Tools, KAPE, CyLR, Volatility).
• Experience with using Service Now SOAR for ticketing and automated response.
• Knowledge of Python, Power Shell and BASH scripting languages.
• Experience with cloud security monitoring and incident response.
• Demonstrated ability to perform static/dynamic malware analysis and reverse engineering.
• Experience with integrating cyber threat intelligence and IOC-based hunting.
• Technical certifications such as:
  Security+, CySA+, Cloud+, Try Hack Me SAL1, Hack the Box CDSA, Cyber Defenders, CCD, Azure SC-900, CCSP, GCIH, CCSK, GSEC, CHFI, GCLD, GCIA.
• Advanced technical certifications such as:
  Security
  
  X/CASP+, PRMP, GREM, GEIR, GNFA, or GCFA.

Peraton is seeking an experienced CIRT Tier 2 Analyst to join Peratons' Federal Strategic Cyber Mission program.

Location:

Beltsville, MD;
On-site

Work Hours:

Mid Shift, 22:00– 6:00 EST, SUN-THU.

• Detect, classify, process, track, and report on cyber security events and incidents.
• Perform advanced in-depth analysis of coordinated Tier 1 alert triage and requests in a 24x7x365 environment.
• Analyze logs from multiple sources (e.g., host logs, EDR, firewalls, intrusion detection systems, servers) to identify, contain, and remediate suspicious activity.
• Characterize and analyze network traffic to identify anomalous activity and potential threats.
• Protect against and prevent potential cyber security threats and vulnerabilities.
• Perform forensic analysis of hosts artifacts, network traffic, and email content.
• Analyze malicious scripts and code to mitigate potential threats.
• Conduct malware analysis to generate IOCs to identify and mitigate threats.
• Collaborate with Department of State teams to analyze and respond to events and incidents.
• Monitor and respond to the CIRT Security Orchestration and Automation Response (SOAR) platform, hotline, email in-boxes.
• Create tickets and initiate workflows as instructed in technical SOPs.
• Coordinate and report incident information to the Cybersecurity and Infrastructure Security Agency (CISA).
• Collaborate with other local, national and international CIRTs as directed.
• Submit alert tuning requests.