Responsibilities:

• Review DoD and open source intelligence for threats
• Identify Indicators of Compromise (IOCs) and integrate those into sensors and SIEMs.
• Triage alerts to identify malicious actors on customer networks.
• Report incidents to customers and USCYBERCOM.
• Motivated self-starter with strong written and verbal communication skills, and the ability to create complex technical reports on analytic findings.

Skills / Experience:

• CND experience (Protect, Detect, Respond and Sustain) within a Computer Incident Response organization or Security Operations Center.
• Demonstrated understanding of the life cycle of network threats, attacks, attack vectors and methods of exploitation with an understanding of intrusion set tactics, techniques and procedures (TTPs).
• Demonstrated understanding of TCP/IP, common networking ports and protocols, traffic flow, system administration, OSI model, defense-in-depth and common security elements.
• In-depth knowledge of architecture, engineering, and operations of at least one enterprise SIEM platform (e.g. Nitro/McAfee Enterprise Security Manager, ArcSight, QRadar, LogLogic, Splunk).
• Experience and proficiency with any of the following: Anti-Virus, HIPS, ID/PS, Full Packet Capture, Host-Based Forensics, Network Forensics.
• Experience with malware analysis concepts and methods.