Cyber Countermeasure Specialist - JB Pearl Harbor, HI

VetJobs; Honolulu (HI); On-site; USD 75,000 - 100,000; Full time

Benefits offered by this job

Health/Dental/Vision

401(k) match

Paid Time Off

STD/LTD/Life Insurance

Referral Bonuses

Professional development reimbursement

Parental leave

Job summary

Quantum Sky seeks a Cyber Countermeasure Specialist to join the DCO team protecting DISA PAC assets at Pearl Harbor, HI. You will engineer and deploy custom detection signatures, firewall rules, and automated blocking across secure networks, spanning NIPRNet to SCI enclaves.

Role requires strong threat intel to action intelligence-driven countermeasures and collaboration with government partners. Onsite positions at Ford Island, with Top Secret/SCI access and DoD compliance.

Qualifications

• Associates degree or higher with cyber defense focus and 2+ years in CND/IDS/IPS or security tooling engineering; or 4+ years with Associate degree.
• Bachelor’s degree with 4+ years or higher in cyber security discipline is preferred; multiple paths accepted.
• Must hold DoD 8140.03 compliant certifications or equivalent within start date.

Responsibilities

• Design, test, and deploy custom intrusion signatures and firewall rules across diverse networks (NIPRNet to JWICS).
• Tune perimeter defenses and automate blocking actions; analyze telemetry to refine defenses.
• Maintain de-confliction and configuration management to sustain stable defensive posture.

Skills

CND

IDS/IPS

Threat intel

Incident response

Scripting (Python, PowerShell)

SOAR playbooks

Education

Associates

Tools

Cisco FirePOWER Management Center

Wireshark

tcpdump

Rally

Job description

Job Description

ATTENTION MILITARY AFFILIATED JOB SEEKERS - Our organization works with partner companies to source qualified talent for their open roles. The following position is available to Veterans, Transitioning Military, National Guard and Reserve Members, Military Spouses, Wounded Warriors, and their Caregivers.

All positions are onsite, unless otherwise stated.

Quantum Sky seeks an experienced Cyber Countermeasure Specialist to join our Network Assurance and Defensive Cyber Operations (DCO) team supporting the Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, HI. Operating under the Global Services Management – Operations II (GSM‑O II) Task Order 22 (TN22) Boundary Cyber Defense and Cybersecurity Services Provider (CSSP) contract, our mission is to safeguard the Department of Defense Information Network (DODIN/DISN), U.S. Pacific Command (USPACOM), and aligned mission partner enclaves against sophisticated advanced persistent threats and nation‑state cyber actors.

In this mission‑critical role, you will bridge the gap between threat intelligence, incident analysis, and active network defense. You will be responsible for the engineering, testing, validation, deployment, de‑confliction, and lifecycle tracking of custom detection signatures, firewall rules, automated blocking mechanisms, and mitigation actions across global boundary sensors, cloud access points, enterprise SIEM platforms, and specialized networks—spanning Unclassified (NIPRNet) and Secret (SIPRNet) up to Top Secret/SCI.

Enterprise Boundary Defenses & Countermeasure Deployment

• Custom Signature Development: Design, author, test, and deploy custom detection and prevention signatures for Antivirus, Network Intrusion Detection/Prevention Systems, Web Content Filtering, and Enterprise Recursive Services to counter zero-day exploits, spear-phishing, Java/Adobe vulnerabilities, and SQL injection attacks.
• Perimeter Defense Tuning: Formulate active countermeasures across DISA Enterprise Boundaries—including Internet Access Points, Boundary Cloud Access Points, and DODIN DMZs—utilizing Cisco FirePOWER Management Center, Next Generation Sensors, Open Sensor Platform, Arbor, and Cloud-Based Internet Isolation.
• Automated Blocking & Telemetry Analysis: Analyze telemetry from automated blocking tools to evaluate blocked versus allowed traffic, conduct root-cause assessments on events that bypassed automated defenses, and refine blocking algorithms to eliminate false positives and false negatives.
• Countermeasure Tracking & De-confliction: Track all deployed customer and enterprise countermeasures; document de-confliction actions and configuration management changes to ensure boundary defensive posture remains synchronized and uninterrupted without adverse impacts on operational network stability.
• Rollback & Network Freeze Procedures: Execute and maintain rapid-rollback procedures to immediately restore network devices and sensors to their operative baseline state should defensive actions impact mission availability, adhering strictly to government-directed network freeze conditions.

Cybersecurity Services Provider (CSSP) & Multi-Cloud Mitigation

• Signature & Rule Lifecycle Management: Lead end-to-end lifecycle management of signatures and detection rules, including periodic reviews, tuning, retirement of redundant/outdated detections, and monthly reporting of custom countermeasures.
• Zero Trust & Multi-Cloud Defense Engineering: Develop and execute tailored countermeasures across enterprise cloud and Zero Trust environments, including Joint Warfighter Cloud Capability CSPs (AWS GovCloud, Azure Government, Google Cloud Platform, Oracle Cloud Infrastructure), Thunderdome Zero Trust Network Access (ZTNA), and Microsoft Defender suite (EndGuard).
• Discovery Counter Infiltration (DCI) & Deliberate Defense (DD): Collaborate with threat analysts to translate warning intelligence and Attack Sensing and Warning data into concrete countermeasures; automate repeatable mitigation actions and convert tactical hunt hypotheses into production analytics.
• Trend & Statistical Analysis: Perform rigorous trend analysis on incident response actions and defense performance; contribute to the monthly Respond Statistical and Trend Report detailing signatures created, intelligence-driven rulesets, and mitigation effectiveness.
• Command & Regulatory Reporting: Ensure all containment and countermeasure actions comply with CJCSM 6510.01F and DoDI 8530.01 standards; log response data in the DoD-mandated Incident Reporting Structure (currently Rally) and issue technical mitigation recommendations to the DISA Joint Operations Center (DJOC).

Location‑Specific & Above‑Secret Defense: INDOPACOM & TS/SCI Enclaves

• PACOM Mission Network (PMN) and Joint Operational Edge – Coalition Environment (JOE‑CE) Countermeasures: Develop and deploy specialized countermeasures for the PMN and JOE‑CE architectures at DISA PAC, leveraging Mission Edge Compute endpoints, Identity Credential and Access Management integrations, and User and Entity Behavior Analytics.
• Defensive Automation & Playbook Optimization: Identify areas where security orchestration adds measurable value; author and enrich SOAR playbooks, custom API workflows, and scripts to automate containment actions during critical security events.
• SCIF‑Based Multi‑Level Operations: Operate within Sensitive Compartmented Information Facilities (SCIF) at Ford Island, applying countermeasures across classified enclaves up to Top Secret / SCI (JWICS and YLAN).
• Enterprise Coordination: Coordinate technical responses and rule modifications with the DISA Field Office Commander, USPACOM J6, DoD Cyber Defense Command (DCDC), USCYBERCOM, and commercial vendors to resolve complex exploit techniques.

Minimum Education Required

Associates

Qualifications

Required Experience

• Level II (Intermediate): Bachelor’s degree in Cybersecurity, Computer Science, Computer Engineering, Information Systems, or a related technical discipline with 2+ years of direct experience in Computer Network Defense (CND), intrusion detection/prevention, or security tool engineering; OR an Associate degree with 4+ years; OR 6+ years of relevant professional/military cyber operations experience in lieu of a degree.
• Level III (Senior): Bachelor’s degree with 4+ years of relevant experience; OR an Associate degree with 6+ years; OR 8+ years of relevant experience / military service in lieu of a degree.
• Must hold a valid certification or degree compliant with DoD 8140.03 / DCWF Work Role Code 521: Cyber Defense Infrastructure Support Specialist (Basic or Intermediate level) prior to start date:
• Accepted Certifications include: CompTIA Security+ CE, CySA+, CCNA‑Security, CND, SSCP, GICSP, GSEC, or advanced certifications such as CASP+ CE, CCNP Security, GCIA, GCIH, or CISSP.
• Ability to obtain the required Computing Environment (CE) certification within 6 months of start date (e.g., Cisco Certified CyberOps Associate/Professional, Cisco FirePOWER specialist credential, Snort Rule Writing certification, or Microsoft SC‑200).
• Proven experience writing, testing, and deploying custom intrusion signatures (e.g., Snort, Suricata, YARA, Bro/Zeek) and firewall/ACL rule configurations.
• Working administrative knowledge of Cisco FirePOWER Management Center (FMC), IDS/IPS appliances, and proxy/web content filtering solutions.
• Deep understanding of network protocols (TCP/IP, UDP, ICMP, DNS, HTTP/S, TLS) and packet inspection tools (Wireshark, tcpdump).
• Familiarity with adversary tactics, techniques, and procedures (TTPs) and the MITRE ATT&CK®
• Ability to participate in an on‑call rotation for emergency after‑hours surge or high‑priority operational containment events.
• Must be a U.S. Citizen.

Clearance

• Active Top Secret security clearance with eligibility to obtain SCI access upon start (Tier 5 / SSBI investigation within scope). Candidates holding an active Secret clearance may be considered provided Top Secret/SCI processing begins immediately upon hire with government approval.

About Quantum Sky

Compensation

Compensation is unique to each candidate and relative to the skills and experience they bring to the position. The salary range for this position is typically between $95,000-$120,000. This does not guarantee a specific salary as compensation is based upon multiple factors such as education, experience, certifications, and other requirements, and may fall outside of the above‑stated range.

Benefits

• Health/Dental/Vision
• 401(k) match
• Paid Time Off
• STD/LTD/Life Insurance
• Referral Bonuses
• professional development reimbursement
• parental leave

Desired

Preferred Experience

• Prior experience supporting DISA or Service Cyber Components (ARCYBER, AFCYBER, FLTCYBER, MARFORCYBER).
• Hands‑on experience developing automated incident response workflows or SOAR playbooks (e.g., Cortex XSOAR, Splunk SOAR/Phantom, Sentinel Logic Apps).
• Scripting expertise in Python, PowerShell, Bash, or Regular Expressions (Regex) for signature creation and data parsing.
• Knowledge of endpoint detection and response (EDR) platforms (Microsoft Defender for Endpoint, Tanium, CrowdStrike) and their containment actions.
• Familiarity with DoD security policies (DoDI 8530.01, CJCSM 6510.01F) and incident tracking databases (Rally).

Required

Certificates/Security Clearances/Other

• Must hold a valid certification or degree compliant with DoD 8140.03 / DCWF Work Role Code 521: Cyber Defense Infrastructure Support Specialist (Basic or Intermediate level) prior to start date:
• Accepted Certifications include: CompTIA Security+ CE, CySA+, CCNA‑Security, CND, SSCP, GICSP, GSEC, or advanced certifications such as CASP+ CE, CCNP Security, GCIA, GCIH, or CISSP.

Clearance

• Active Top Secret security clearance with eligibility to obtain SCI access upon start (Tier 5 / SSBI investigation within scope). Candidates holding an active Secret clearance may be considered provided Top Secret/SCI processing begins immediately upon hire with government approval.

City

Pearl Harbor

State

Hawaii

Job Category

Cybersecurity

Job Code

Cyber_Security IT

Affiliate Sponsor

Quantum Sky

Salary Range

$75,000-$100,000