Cyber Threat Analyst

Job Description

Clearance Required: Secret

Position Description
:
The Cyber Hunt and Threat Analysis team is seeking a motivated individual with strong technical competency that will research and implement detection measures using data from a wide spectrum of sources. The candidate will also perform opportunistic threat hunting and forensic analysis when required during incidents.

Qualifications
:

• Minimum 3-5 years of comparable experience performing Incident Response, Forensics, Malware Analysis, or Penetration Testing.
• 5-7 years of experience if no degree.
• Must be proficient in at least three of the following disciplines:
  • Network traffic analysis and host based log analysis
  • Comprehensive understanding of enterprise Windows security (Active Directory)
  • Static and Dynamic malware analysis
  • Disk and Memory forensics
  • Practical knowledge in at least one scripting or development language (e.g. Power Shell or Python)

Recommended Education
:
Bachelor’s degree or higher from accredited university/technical college in Cybersecurity, Computer Science, Information Systems, or other related scientific or technical discipline.

Certifications
: 8570 Classification IAT–II & CSSP Certification (Can Attain within 90 Days).

Required Skills
:

• Strong written and verbal communication skills
• Strong understanding of common enterprise technologies
• Ability to convey extremely technical concepts to audiences with varying technical understanding

Responsibilities
:

• Use Network and Host Based data to drive detection, monitoring, and response capabilities
• Create detection analytics based off the MITRE ATT&CK Framework and other security frameworks
• Perform unique research on adversarial Tools, Techniques, and Procedures (TTPs)
• Provide assistance to the Network Security Monitoring team in response to incidents by analyzing host behavior and network traffic
• Perform static and dynamic malware analysis to feed Indicators of Compromise into the Incident Response process

Additional Information
:

• Authorized to update signatures and view alerts of IDS/IPS
• Authorized to view audit records on Central Log Server
• Authorized to modify auditable events on Central Log Server