Corporate Cyber Sec Analyst Sr - Military veterans preferred

2019-04-16
SAIC (www.saic.com)
Other

/yr

  full-time   employee


Oak Ridge
Tennessee
37830
United States

Description

JOB DESCRIPTION:


The SAIC Cyber Security Analyst is responsible for shift lead duties related to the real-time 24/7 monitoring, analysis, and resolution of identified security events. Will support daily security operations center activities utilizing a SIEM and monitor events from multiple sources including but not limited to firewall logs, system logs (Unix and Windows), network and host based intrusion detection systems, applications, databases, and other security information monitoring tools.


  • Perform threat and vulnerability assessment and provide subject matter expertise on appropriate threat mitigation.

  • Identify intrusion activity by leveraging alert data from multiple sensors and systems and determine priority for response.

  • Leverage threat intelligence e.g. DSIE, NCFTA while actively monitoring critical infrastructure components.

  • Assess the impact of potentially malicious traffic on company network and infrastructure.

  • Perform in-depth analysis of anomalies in support of network monitoring and incident response operations.

  • Perform live incident response (reactive and proactive incident management) by identifying and remediating malicious applications and infrastructure components.

  • Collaborate with other Information Security and IT team members to develop and implement innovative strategies for monitoring and preventing attacks.

  • Develop appropriate metrics (key risk and performance indicators) to measure the monitoring program and related process.

  • Develop/Monitor basic IDS/IPS rules to identify and/or prevent malicious activity.

  • Develop and test new correlation content and use cases using SIEM filters, rules, data monitors, active lists, and session lists

  • Conduct research of emerging security threats.

  • Propose additional components and techniques that could be used to proactively detect and prevent malicious activity.

  • Provide other services as a key member of the Cyber Security Operations Team:

    • Security review and administration of changes to networks, servers and end point devices in collaboration with network operations.

    • Security sensor policies for IDS/IPS, Firewalls, web security gateway, logging.

    • Continuous Control Monitoring including Baseline Security - Configuration monitoring. - Investigations and Forensics

  • Provide escalated response and support to intrusion or security breach investigations

  • Documentation of all incidents and tickets in the appropriate systems before the end of each shift

  • Participate in knowledge sharing with other analysts and writing technical articles for Internal Knowledge Bases

  • Present with confidence, findings of an investigation

  • Designs, tests, and implements secure operating systems, networks, security monitoring, tuning and management of IT security systems and applications, incident response, digital forensics, loss prevention, and eDiscovery actions.

  • Conducts risk and vulnerability assessment at the network, system and application level.

  • Conducts threat modeling exercises.

  • Develops and implements security controls and formulates operational risk mitigations along with assisting in security awareness programs.

  • Involved in a wide range of security issues including architectures, firewalls, electronic data traffic, and network access.

  • Researches, evaluates and recommends new security tools, techniques, and technologies and introduces them to the enterprise in alignment with IT security strategy.

  • Utilizes tools and processes/procedures in order to scan, identify, contain, mitigate and remediate vulnerabilities, and intrusions. 

  • Assists in the implementation of the required policy and makes recommendations on process tailoring.

  • Performs analyses to validate established security requirements and to recommend additional security requirements and safeguards.

  • Supports security tests and evaluations required by any government accrediting authority through pre-test preparations, participation in the tests, analysis of the results, and preparation of required reports.

  • Periodically conducts a review of each system's audits and monitors corrective actions until all actions are closed.  May support cyber metrics development, maintenance and reporting.

  • May provide briefings to senior staff.

  • Performing documentation review and improvement

  • Attending meetings as needed

  • Communicate and escalate issues and incidents as required by process or management

  • Additional responsibilities will include the ability to perform shift lead duties and train, mentor, and provide oversight to Junior Security Analysts.



Job Duties:


Threat Intel:


  • Perform threat and vulnerability assessment.

  • Identify intrusion activity.

  • Leverage threat intelligence e.g. DSIE, NCFTA.

  • Assess the impact of potentially malicious traffic on company network and infrastructure.

  • Perform in-depth analysis of environmental anomalies.

  • Perform live incident response by identifying and remediating malicious activity.

  • Collaborate with other Information Security and IT team members.

  • Develop appropriate metrics (key risk and performance indicators) to measure the monitoring program and related process.

  • Monitor basic IDS/IPS rules to identify and/or prevent malicious activity.

  • Conduct research of emerging security threats.

  • Propose additional components and techniques that could be used to proactively detect and prevent malicious activity.


Splunk


  • Develop and test new correlation content and use cases using SplunkES filters, rules, data monitors, active lists, and session lists

  • Provide second-level Real-time monitoring of security notable events

  • Provide second-level Analysis and research of security notable events

  • Develop resolution process of identified security incidents

  • Investigate and approve/deny IP block requests

  • Identifies false-positives from alerting

  • Perform daily operations utilizing SIEM and monitor events from multiple sources

  • Review event finding submitted by Cyber Security Center Support

  • Assign event analysis and research to Cyber Security Center Support as needed

  • Mentor Cyber Security Center Support


Archer


  • Make decision regarding escalation

  • Create incident ticket as needed

  • Communicate and escalate issues and incidents as required by process or management

  • Maintain status and update event tickets as needed


Vulnerability Scanning


  • Monitor and respond to vulnerability scanning requests per process

  • Build and run vulnerability scans

  • Monitor vulnerability scans

  • Address any vulnerability scan issues

  • Review scan reports and follow-up with system stakeholders


General


  • Responsible for meeting all SLA requirements during shift

  • Performing documentation review and improvement

  • Attending meetings as needed

  • Documentation of all incidents tickets in the appropriate systems

  • Complete and post shift log at end of each shift

  • Participate in knowledge sharing with other analysts

  • Present with confidence, findings of an investigation

  • Additional responsibilities will include the ability to perform shift lead duties and train, mentor, and provide oversight to Cyber Security Center Support

  • Cover shift rotation, including weekends and holidays of a 24/7 operation



Qualifications

TYPICAL EDUCATION AND EXPERIENCE: Bachelors and five (5) years or more experience; Masters and three (3) years or more experience; PhD and 0 years related experience.