Cyber Countermeasure Specialist; TN

Job Summary – Position Eligible for $10,000 Sign-on Bonus – Subject to 12 Month Commitment

Newberry Group is seeking an experienced Cyber Countermeasure Specialist to join our customer’s Network Assurance and Defensive Cyber Operations (DCO) team supporting the Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, HI. Operating under the Global Services Management – Operations II (GSM-O II) Task Order 22 (TN22) Boundary Cyber Defense and Cybersecurity Services Provider (CSSP) contract, our mission is to safeguard the Department of Defense Information Network (DODIN/DISN), U.S. Pacific Command (USPACOM), and aligned mission partner enclaves against sophisticated advanced persistent threats and nation-state cyber actors

Location

This is a full-time onsite role in Ford Island, HI. Telework is not permitted.

Relocation expenses may be eligible for reimbursement of up to $10,000.

Clearance

DoD Active Top Secret clearance required with SCI Eligibility;
Secret clearance level may be acceptable with Government approval.

Salary $115,000 to $150,000 annually - depending on experience and position level.

Travel

Yes, 10% of the time.

Responsibilities and Duties

• Custom Signature Development: Design, author, test, and deploy custom detection and prevention signatures for Antivirus, Network Intrusion Detection/Prevention Systems, Web Content Filtering, and Enterprise Recursive Services to counter zero-day exploits, spear-phishing, Java/Adobe vulnerabilities, and SQL injection attacks.
• Perimeter Defense Tuning: Formulate active countermeasures across DISA Enterprise Boundaries—including Internet Access Points, Boundary Cloud Access Points, and DODIN DMZs—utilizing Cisco FirePOWER Management Center, Next Generation Sensors, Open Sensor Platform, Arbor, and Cloud-Based Internet Isolation.
• Automated Blocking & Telemetry Analysis: Analyze telemetry from automated blocking tools to evaluate blocked versus allowed traffic, conduct root-cause assessments on events that bypassed automated defenses, and refine blocking algorithms to eliminate false positives and false negatives.
• Countermeasure Tracking & De-confliction: Track all deployed customer and enterprise countermeasures; document de-confliction actions and configuration management changes to ensure boundary defensive posture remains synchronized and uninterrupted without adverse impacts on operational network stability.
• Rollback & Network Freeze Procedures: Execute and maintain rapid-rollback procedures to immediately restore network devices and sensors to their operative baseline state should defensive actions impact mission availability, adhering strictly to government-directed network freeze conditions.

• Signature & Rule Lifecycle Management: Lead end-to-end lifecycle management of signatures and detection rules, including periodic reviews, tuning, retirement of redundant/outdated detections, and monthly reporting of custom countermeasures.
• Zero Trust & Multi-Cloud Defense Engineering: Develop and execute tailored countermeasures across enterprise cloud and Zero Trust environments, including Joint Warfighter Cloud Capability CSPs (AWS Gov Cloud, Azure Government, Google Cloud Platform, Oracle Cloud Infrastructure), Thunderdome Zero Trust Network Access (ZTNA), and Microsoft Defender suite (End Guard).
• Discovery Counter Infiltration (DCI) & Deliberate Defense (DD): Collaborate with threat analysts to translate warning intelligence and Attack Sensing and Warning data into concrete countermeasures; automate repeatable mitigation actions and convert tactical hunt hypotheses into production…