Cybersecurity Operations Specialist

Cybersecurity Operations Specialist

Freedom Technology Solutions Group is looking for a Cybersecurity Operations Specialist to provide CSOC Tier 2 and 3 services. The role requires 24x7x365 coordination, execution, and implementation of all actions for containment, eradication, and recovery of cyber incidents. CSOC Tier 3 responsibilities include malware and implant analysis, forensic artifact handling and analysis, and support under a Government CIRT Commander. The contractor will conduct continuous exercises and dry runs to improve response outcomes when not in an incident response period.

• Coordinate and execute tasks, perform analysis, and build/document response activities during cyber security incident response.
• Implement containment measures such as IP blocks, domain blocks, and disabling user accounts on direction of the Government.
• Coordinate with Security and Installations Directorate, Insider Threat Office, and other law enforcement and counterintelligence personnel for advanced investigation and triage of incidents.
• Collaborate with authorities to produce security incident reports.
• Categorize incidents and events.
• Coordinate with other contracts, organizations, and services to ensure incidents are reported, contained, and eradicated properly.
• De-conflict blue/red team activity with open incidents/events.
• Assist NGA in incident recovery.
• Build timelines, documents, briefings, and other products to inform stakeholders of response actions and impacts.
• Document actions and analysis in the authorized ticketing system with reconstructable detail.
• Generate and update reports in the Joint Incident Management System (JIMS), Incident Case Management System (ICMS), and other authorized reporting systems.
• Develop, maintain, sustain, and execute custom scripts, tools, and capabilities for data collection, analysis, and incident response.
• Perform digital media analysis on host, server, and network data, including volatile and non-volatile memory and system artifact collection.
• Identify and send indicators of compromise to cybersecurity stakeholders and other contract services.
• Provide adversary attribution.
• Perform malware analysis and signature development.
• Coordinate with CSOC Tier 1 and 2 services to remediate discrepancies and provide recommendations to prevent recurrence.

• Bachelor’s degree or 6 years of experience in Cyber Security (CSO).
• Active TS/SCI clearance with ability to obtain a polygraph.
• DoDD 8140.01 and DoD 8570.01-M IAT Level II and CSSP Incident Responder certification.
• Serve as C-IRT member and work under the direct control of the Government C-IRT Commander as required.
• Develop and coordinate courses of action with government and contract stakeholders; execute Defensive Cyberspace Operations on NGA networks and systems when authorized.
• Perform digital media analysis and malware reverse engineering on host, server, and network data.
• Execute custom scripts, tools, and capabilities for data collection and analysis when authorized.
• Develop, document, and provide incident investigation reports within 30 days of C-IRT stand‑down.
• Conduct quality control reviews of a percentage of closed CSOC Tier 2 tickets weekly to ensure proper analysis, categorization, documentation, and notification.

• IAT III certification.

• Flexible work environment.
• Collaborative team culture with friendly, like‑minded professionals.
• Access to innovative, cutting‑edge technologies.
• Competitive compensation and benefits, including matching 401(k), fully paid medical, life and disability insurance.
• Generous paid time off, including paid site closure days.
• Paid training and tuition reimbursement.
• Company‑sponsored events (game nights, holiday party, summer party, happy hours).

As an Equal Opportunity Employer, we do not discriminate on the basis of race, color, religion, sex, age, marital status, disability, or veteran status.

Accessibility:
If you need an accommodation as part of the employment process, please contact Human Resources at 410‑290‑9035.