General Dynamics Information Technology (www.gdit.com)
Full Time Employee
General Dynamics Information Technology has an opening for a Cyber Threat Intelligence Analyst working at the Defense Cyber Crime Center located in LInthicum; MD. This is an exciting dynamic position analyzing and writing reports for the wider Intelligence and Law Enforcement communities.
Provides analysis and research for national security, infrastructure, technology, country, geographic area, biographic and targeted vulnerability.
* Prepares assessments of current threats and trends based on the sophisticated collection, research and analysis of classified and open source information.
* Develops and maintains analytical procedures to meet changing requirements and ensure maximum operational success.
* Collects data using a combination of standard intelligence methods and business processes.
* Provides guidance and work leadership to less-experienced staff, and may have supervisory responsibilities.
* Maintains current knowledge of relevant technologies and subject areas.
* Participates in special projects as required
* Bachelors Degree in a related technical or military discipline.
* Masters Degree preferred.
* 10-15 years of related experience supporting intelligence operations.
BA/BS degree in Information Technology or Information Security, Computer Science, Intelligence Studies, Cyber Security or another related field of study or equivalent 3+ years performing technical cyber threat intelligence analysis.
* Strong technical skills proficiency in the following areas: network communication using TCP/IP protocols, basic system administration, basic understanding of malware (malware communication, installation, malware types), intermediate knowledge of computer network defense operations (proxy, firewall, IDS/IPS, router/switch) and open source information collection. Candidate must have a thorough understanding of Domain Name Service records.
* Strong knowledge of Cyber Threat Intelligence principles to include indicators of compromise (IOC) types, indicator pivoting and indicator attribution strength.
* Strong understanding of US Intelligence Community and how cyber intelligence organizations work together for purposes of conducting cyber threat analysis
* Strong proficiency and recent experience (within last 3 years) performing NETFLOW and PCAP analysis using common analysis tools (examples include Wireshark, Splunk, ChopShop, Dshell, Network Miner, Moloch, etc). Candidate must be strongly proficient at sessionizing PCAP data, identifying and decoding protocols, extracting files, and applying standard filters such as Berkley Packet Filter (BPF).
* Strong proficiency Report writing - a technical writing sample and technical editing test will be required if the candidate has no prior published intelligence analysis reporting
* Strong or Intermediate ability to apply formal intelligence analysis methods, develop hypothesis, prove/disprove relationships, always ask why, defend your analysis, and apply attribution to cyber threat activity. Candidate must be able to make confidence-based assessments for purposes of attribution based on their technical analysis of network traffic, multi-source data, malware and system forensic analysis. Candidate must be able to identify analytic bias.
* Intermediate ability to build intrusion related data visualizations and perform analysis (i.e., using I2 Analyst Notebook, Netviz, Palantir, etc)
* Intermediate ability to present technical information and analysis to groups up to 50 persons on a quarterly basis. Candidate will be required to brief smaller groups up to 10 persons on a weekly basis.
* Self-starter with the ability to proactively engage and develop relationships with intrusion set subject matter experts and analyst counterparts across the US Intelligence and Law Enforcement communities
Chinese Mandarin language, ILR 3/3 level of general proficiency (or equivalent certified language training standard) with a test date in the last 3 years
* Formal training as an intelligence analyst in any discipline – graduate of US Govt intelligence analysis course: CAC, IBC, Kent School, IC 101, Analysis 101, Army, Navy, Air Force, etc
* Experience applying Kill Chain analysis, Cyber Intelligence Preparation of the Environment (CIPE) modeling, or Diamond modeling of cyber threat activity
* Certifications (any): CISSP, CEH, Security+, SANS certification(s), Network+, CCNA
* Advanced NETFLOW and PCAP Analysis
* Advanced Data Visualization proficiency leveraging COTS/GOTS tools
* Technical Skills proficiency: Python language, encryption technologies/standards
* Intermediate malware analysis or digital computer forensics experience
* Any type of Cyber related Law Enforcement or Counterintelligence experience
* Existing Subject Matter Expert of Advanced Persistent Threat activity
* Experience using COTS/Open Source tools: Novetta Cyber Analytics, Mitre ChopShop and/or ARL DSHELL
* Analyst experience in Federal Cyber Center, NSA, or Corporate CIRT
Department of Defense TOP SECRET/SCI security clearance at time of hire. Must be eligible to obtain a Counterintelligence Polygraph after starting work.
Applicants selected will be subject to a U.S. Government security investigation and must meet eligibility requirements for access to classified information. Due to the nature of work performed within our facilities; U.S. citizenship is required.
As a trusted systems integrator for more than 50 years, General Dynamics Information Technology provides information technology (IT), systems engineering, professional services and simulation and training to customers in the defense, federal civilian government, health, homeland security, intelligence, state and local government and commercial sectors.With approximately 32,000 professionals worldwide, the company delivers IT enterprise solutions, manages large-scale, mission-critical IT programs and provides mission support services.GDIT is an Equal Opportunity/Affirmative Action Employer - Minorities/Females/Protected Veterans/Individuals with Disabilities.
To apply for this job, contact: