Cyber Response Analyst / Active TS/SCI

Peraton; Wiesbaden; Hybrid; EUR 70.000 - 100.000; Vollzeit

Zusammenfassung

Peraton is seeking an experienced Cyber Response Analyst for its Regional Cyber Center-Europe, onsite in Wiesbaden, Germany. You will monitor IDS/SIEM platforms, triage alerts, and perform malware analysis to define threat scope and impact.

Responsibilities include documenting incidents, supporting containment, and coordinating with mission partners. U.S. citizenship and a DoD TS/SCI clearance are required, with active certifications as listed.

Qualifikationen

• Bachelor's degree (STEM/Business Admin) with 5+ years cybersecurity experience, or associate degree with 7+ years in lieu of bachelor
• Active DoD TS/SCI clearance or higher
• DoD 8140 Cybersecurity Advanced
• U.S. citizenship required
• TESA Qualification required

Aufgaben

• Monitor IDS/SIEM platforms (Elastic, Splunk, ArcSight) for security events across DoD networks
• Triage, analyze, and elevate security alerts per CSSP SOPs
• Conduct initial malware analysis of suspicious files/URLs to determine threat scope
• Document incidents from detection to containment with evidence in ticketing system
• Support incident response actions including host isolation and coordination with network operations
• Produce shift reports and incident tickets with timelines and follow-on steps

Kenntnisse

Cybersecurity incident response

Threat intelligence

Network forensics

Malware analysis

Scripting (Python or Bash)

Ausbildung

Bachelor's degree in STEM or Business Administration

Tools

Elastic Stack

Splunk

Wireshark

MITRE ATT&CK

Cuckoo Sandbox

TheHive

Jobbeschreibung

Required:

• Bachelor's degree (STEM/Business Admin) and a minimum of 5 years of cybersecurity experience, or an associates degree and minimum of 7 years of relevant experience, or 11 total years of relevant experience in lieu of the bachelors degree requirement
• Must meet TESA Qualification
• DoD 8140 - Cybersecurity (Cyber Defense Incident Responder) - Advanced
• Certifications — must hold active certifications (one of the following):
• Cisco CyberOps Professional; OR
• SANS (any GIAC certification); OR
• Blue Team Level 1; OR
• Microsoft Certified: Security Operations Analyst Associate
• U.S. citizenship required
• Active DoD TS/SCI clearance or higher

Preferred:

• Hands-on experience with Elastic Stack (Elasticsearch, Kibana, Logstash) or Splunk for security event monitoring
• Proficiency with Wireshark or similar packet analysis tools for network traffic inspection
• Familiarity with MITRE ATT&CK framework for mapping adversary TTPs to observed activity
• Experience with malware analysis tools (e.g., Cuckoo Sandbox, Any.Run, VirusTotal)
• Working knowledge of TheHive or similar incident case management platforms
• Experience with network forensics and log analysis across firewall, DNS, and proxy sources
• Familiarity with NIST SP 800-61 incident response lifecycle
• Exposure to scripting (Python or Bash) for alert triage automation

Peraton is seeking to hire an experienced Cyber Response Analyst for its' Regional Cyber Center-Europe

Location: On-site, Wiesbaden, Germany

Responsibilities:

• Monitor IDS/SIEM platforms (Elastic, Splunk, ArcSight) for security events, anomalies, and indicators of compromise across DoD networks in the USAREUR-AF AOR
• Triage, analyze, and elevate security alerts in accordance with CSSP standard operating procedures, ensuring timely notification to senior analysts and mission partners
• Conduct initial malware analysis and static/dynamic examination of suspicious files, URLs, and artifacts to determine threat scope and impact
• Document security incidents from initial detection through containment, recording all actions, findings, and evidence in the incident tracking system
• Support incident response actions including host isolation, evidence collection, and coordination with network operations and mission owners
• Produce accurate and timely shift reports, end-of-day summaries, and incident tickets that capture event timelines, analyst actions, and recommended follow-on steps

#RCC-E