Security Analyst - Tier 1

CVP is an award-winning healthcare and next-gen technology consulting firm recognized for excellence and innovation in the solutions we have provided our clients across healthcare, national security, and the public sector.

We are seeking a Security Analyst to join our team of experts tasked with securing the critical networks and systems our clients depend on.

This is a day shift position onsite two days a week in Kansas City, Missouri and remote three days a week.

• Perform cybersecurity activities as part of a team in an organization’s 24x7 Security Operations Center (SOC).
• Use data collected from a variety of cyber defense tools (e.g., intrusion detection system (IDS) alerts, firewalls, network traffic logs, Security Incident and Event Management (SIEM) to analyze events that occur within the environment for the purposes of mitigating threats in support of an organization’s security program.
• Work with stakeholders to resolve computer security incidents and vulnerability compliance.
• Conduct vulnerability scans and recognize vulnerabilities in security systems.
• Apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
• Apply techniques for detecting host and network-based intrusions using intrusion detection technologies.
• Interpret the information collected by network tools (e.g. Nslookup, Ping, and Trace route).
• Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.
• Coordinate with SOC team and cyber defense staff to validate network alerts.
• Document and escalad incidents (including event's history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.
• Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack.
• Provide daily summary reports of network events and activity relevant to cyber defense practices.
• Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts.
• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.
• Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity.
• Examine network topologies to understand data flows through the network.
• Identify and analyze anomalies in network traffic using metadata (e.g., CENTAUR).
• Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.
• Isolate and remove malware.
• Identify applications and operating systems of a network device based on network traffic.
• Notify designated managers, cyber incident responders, stakeholders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan.
• Detect host and network based intrusions via intrusion detection technologies (e.g., Snort).
• Recognize and categorize types of vulnerabilities and associated attacks.
• Recognize vulnerabilities in security systems. (e.g., vulnerability and compliance scanning).
• Apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
• Identify cyber threats which may jeopardize organization and/or partner interests.
• Monitor security events involving high value assets.
• Conduct computer network defense (CND) triage to include
  • Determine scope, urgency, and potential impact.
  • Identify specific vulnerability(s).
  • Recommend remediation actions.
  • Prepare reports on incident findings to appropriate agencies.
• Maintain appropriate technical and procedural documentation.
• Properly document all investigative activity is in the tracking/ticketing systems.
• Follow-up with relevant support teams on actions being taken until…