Specialized Security Source Analyst; Insider Threat

Security Clearance

Requires TS/SCI clearance.

• Provide all-source analytic support to the DCSA Insider Threat program, leveraging education, expertise, and DoD population understanding to accomplish specific tasks.
• Provide Insider Threat support services; analysts conduct comprehensive all-source research, analysis, and fusion of traditional and non‑traditional sources supporting the Insider Threat mission, and produce all-source InT‑related products for diverse customers in DoD, intelligence, security, law enforcement, and senior audiences.
• Aggregate, analyze, and evaluate all available InT government and open-source information to assist risk evaluation related to InT.
• Extract and organize statistical data to support building quantitative and qualitative metrics products, summaries, case studies, and trend products.
• Communicate complex ideas and analyses orally and in writing.
• Plan and conduct thorough research using all available InT tools and data sources to discover necessary information for analysis, independently or as part of a larger analytical effort.
• Assist in preparation and production of risk warning and situational awareness products related to InT issues.
• Assist in preparation and production of analytical products, identifying areas for efficiencies in the production process.
• Provide editing and quality control of InT products, communicating recommendations orally and in writing.
• Review InT information to meet mission requirements and timelines.
• Propose and define new UAM policy triggers.
• Perform functional testing of proposed and modified policy triggers prior to implementation and final government approval.
• Prepare policy trigger implementation plan and impact assessment; present findings in support of new UAM policy triggers.
• Review and appropriately upscale events triggered in the UAM tool.
• Perform configuration management activities to ensure compliance with asset management and continuous monitoring policy requirements.
• Understand and implement established policy technical and workflow procedures.
• Prepare, write, and present reports and briefings as required; provide written support for UAM policy approval requests.
• Support analytic and operational activities to assemble, correlate, evaluate, and assess information concerning counterintelligence, security, human capital, and information assurance related insider threats against DCSA personnel, programs, information systems, and facilities.
• Apply knowledge of CNE tactics, techniques, and procedures associated with advanced cyber threats to develop analytical signatures and filters refining anomaly detection with the Insider Threat Program datastore/databases internal to the organization, including understanding specific content read, moved, and altered within the organization and applying contextual analysis.
• Perform event analysis by examining network traffic data, host‑based security systems audit data, SIEM data, and other technical feeds from agency security tools.
• Analyze and disseminate insider threat analysis information as required, and perform insider threat analysis, forecasts, and threat alerts with recommended countermeasures, including new policy trigger protocols or tuning of existing policies.
• Prepare formal analysis products and reports with findings and recommendations; present briefings as subject matter expert as required.
• Make policy trigger recommendations to the government to enhance current capabilities and tune current policy triggers.
• Focus on anomalous network activity and capture human behaviors such as policy violations, compliance incidents, and malicious acts at endpoint that can serve as warning signs leading to breach.
• Effectively detect unauthorized access and unauthorized transfer of information; deploy for audits and inquiries across multiple network architectures using a wide variety of security tools.