Staffing Pros, a division of VETS Inc., is recruiting for a full-time Senior Tier 2 Monitoring Analyst onsite in Arlington, VA. An Active Secret clearance is required for this role.
This position is located in Arlington, VA and will be onsite 5 days a week. No hybrid/telework allowed.
This position will support Sunday Thursday 6:00am to 2:00pm.
Responsibilities:
- Support the Cyber Incident Response Team (CIRT) and will be responsible for running day to day operations and analysis of the team.
- Develop the overall maturity of the team both from a holistic and professional level.
- This person is also the liaison between other CIRT teams and contract/government management.
- Provide Monitoring support in a 24x7x365 environment.
- Provide leadership and mentoring to security analysts.
- Share in-depth knowledge and intelligence gained from cyber security events with stakeholders.
- Protect against and prevent potential cyber security threats and vulnerabilities.
- Monitor and analyze network traffic to identify potential security threats and vulnerabilities.
- Monitor and analyze Security Information and Event Management (SIEM) alerts to identify security issues for remediation and investigate events and incidents.
- Provide response, technical assistance and expertise for significant cyber incidents, investigations, and related operational events.
- Develop and implement training programs for monitoring analysts.
- Develop and maintain security policies, procedures, and documentation.
- Conduct detailed research to increase awareness and readiness levels of the security operations center.
- Conduct advanced analysis and recommend remediation steps.
- Analyze network events to determine impact.
- Conduct all-source research to determine threat capability and intent.
- Develop and maintain analytical procedures to meet changing requirements.
- Develop content for cyber defense tools.
- Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.
- Determine tactics, techniques, and procedures for intrusion sets.
- Work with stakeholders to resolve computer security incidents and vulnerability compliance.
- Collaborate with cross-functional teams to ensure compliance with security standards and best practices.
- Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.
- Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support incident response.
Required Qualifications:
- Bachelor's degree and minimum 9 Years experience; 7 Years with Masters; 4 Years with PhD. Four (4) additional years of experience can be substituted in lieu of the degree requirement.
- Must possess ONE of the following certifications or the ability to obtain prior to start date:
- CASP+ CE, CCNP Security, CEH, CFR, CHFI, CISA, CISSP (or Associate), Cloud+, CND, CySA+, GCED, GCIH, GICSP, SSCP.
- Security Operations Center experience, network event analysis and/or threat analysis.
- Tuning and/or configuring SIEM and vulnerability tools experience.
- Cloud computing technologies to include Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) experience.
- Expertise in traditional computing technologies architecture, design and security.
- Expertise in planning, implementation and usage of log aggregation and security analysis tools.
- Demonstrated knowledge utilizing native security and logging tools and centralized log aggregation utilizing a variety of methods.
- Demonstrated knowledge of the Incident Response Lifecycle and how it applies to cloud, legacy and hybrid environments.
- Ability to identify remediation steps for cybersecurity events.
- Demonstrated ability to utilize and leverage forensic tools to assist in determining scope and severity of a cybersecurity incident.
- Proven ability to brief (technical/informational) senior leadership.
- Ability to scope and perform impact analysis on incidents.
- U.S. Citizenship required
- An active Secret security clearance.
Preferred Qualifications:
- Knowledge of network architecture, design and security.
- Ability to analyze static and dynamic malware analysis reports.
- Ability to analyze and identify anomalous code as malicious or benign.
- Skill in detecting host and network-based intrusions via intrusion detection technologies.
- Knowledge of which system files (e.g., log files, registry files, configuration files) contain relevant information and where to find those system files.
- Skill in conducting trend analysis.
- Knowledge of adversarial