Cyber Defense Operator (CDO)

IPSecure, Inc; San Antonio (TX); On-site; USD 80,000 - 120,000; Full time

Benefits offered by this job

Unlimited Vacation

Education and Certification Reimbursement Program

401(k) retirement plan with employer match

Medical, Dental, and Vision insurance

Job summary

IPSecure, Inc in San Antonio, Texas seeks a Cyber Defense Operator (CDO) with TS/SCI Level Clearance to conduct thorough event analysis to protect Air Force systems. The role involves incident response, investigations of suspicious activity, and providing security support to AF units.

With responsibilities including incident report documentation and cyber investigations, the ideal candidate should have at least 3 years of relevant experience. Various benefits include medical plans, unlimited vacation, and educational reimbursement programs.

Qualifications

• Active TS/SCI Level Clearance required.
• 3+ years of relevant technical, cyber security, and business work experience preferred.

Responsibilities

• Complete incident response process for escalated CAT events.
• Open network intrusion investigations to validate suspicious activity.
• Analyze host DCO events for higher-level analysis.
• Author and review incident report forms for security incidents.
• Provide computer security-related support to AF field units.

Skills

Incident response

Cyber threat analysis

Security monitoring

Network intrusion detection

Education

Active IAT Level II Certification (e.g., CompTIA Security+)

CSSP Incident Responder Certification (GCFA) within 120 days of hire

Job description

Overview

Cyber Defense Operator (CDO) – TS/SCI Level Clearance Required – Located in San Antonio, Texas. The ability of the Cyber Defense Operator (CDO) is to complete its mission depending upon accurate, timely and thorough event analysis in order to identify intruder or potential intruder activities utilizing host and network monitoring and system logs. The CDO shall correlate information gathered to provide effective methods to protect Air Force (AF) systems. Upon identification of suspicious activity on AF networks, open network intrusion investigations to validate the unauthorized activity and determine the type and extent of activity.

Responsibilities

• When CAT events are escalated to incident response, complete incident response process, including: preparation, identification and scoping, containment, eradication and remediation, recovery, and lessons learned.
• Open network intrusion investigations to validate suspicious activity on AF networks and determine the type and extent of activity.
• Provide AF Office of Special Investigations (OSI) DCO technical support to law enforcement and counter‑intelligence agencies and activities if required.
• Participate in and contribute to lessons learned meetings and briefings.
• Support planned and same‑day Incident Response deployments.
• Comply with third‑party MOU/MOA monitoring and reporting requirements. Analyze host DCO events to determine the necessity for higher‑level analysis and conduct an initial assessment of type and extent of intruder activities.
• Conduct cyber investigations to determine the initial vector and overall intrusion timeline, accurately identify the threat, determine the full scope of impact, and develop containment and remediation actions for approval.
• Author and review incident report forms (IRFs) for security incidents within JEMS. Ensure the document is accurate and provides the correct amount of technical detail needed. (CDRL A008)
• Generate end of mission reports (MISREPS) and provide pass‑on information for knowledge transfer to subsequent crews of analysts on duty regarding the latest suspicious traffic seen from a given port, IP, etc., with no more than a 5% error rate.
• Provide computer security‑related support to AF field units as directed by CCC, countering vulnerabilities, minimizing risk, and improving the security posture of AF computers, networks, and systems within the scope of AFIN SOC operational requirements and mission execution.
• Participate in planning, briefing, and debriefing tasks as directed by the CDO Mission Lead or Crew Commander.
• Provide feedback on detection mechanisms that are true positives and false positives to ESM and Content Development as applicable.
• Design incident response plans (IRP) as directed by the Crew Commander. Ensure CDOs are briefed on objectives, ROEs, plans, contingencies, and applicable TTPs.
• Accomplish assigned weapon system access, ORM, Go/No Go, reports, TTP updates, and TAR submissions.

Basic Qualifications

• Active TS/SCI Level Clearance.
• Active IAT Level II Certification (e.g., CompTIA Security+).
• Ability to gain the CSSP Incident Responder Certification (GCFA) within 120 days of hire date.

Preferred Qualifications

• 3+ years of relevant technical, cyber security, and business work experience.

Benefits

Medical, Dental, Vision, Unlimited Vacation, Sick Leave, Paid Federal Holidays, Education and Certification Reimbursement Program, 401(k) retirement plan with safe harbor employer match after 3 months, Prepaid legal plan and ID protection plan available, Accident Insurance, Critical Illness Insurance, and Hospital Indemnity Insurance available.

EEOC Statement

IPSecure does not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, disability or status as a protected veteran.