Cyber Network Defense Analyst II

Solutions3 LLC; Arlington (VA); Hybrid; USD 110,000 - 170,000; Full time

Job summary

Solutions³ LLC is seeking a Cyber Network Defense Analyst II to support a government mission, performing investigations to assess breach severity and develop mitigation plans. The role requires US citizenship, active TS/SCI clearance, and DHS suitability prior to start, with at least 2+ years of cyber defense experience.

The analyst will characterize network traffic, validate alerts, document incidents, and produce daily reports while using IDS/monitoring tools to detect and respond to

Qualifications

• Bachelor's degree in a related field or 4+ years of network investigations experience.
• Experience developing and deploying signatures is desirable.
• Experience reading and interpreting signatures (e.g., Snort).

Responsibilities

• Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.
• Coordinate with enterprise-wide cyber defense staff to validate network alerts.
• Document and escalate incidents with history, status, and potential impact for action.
• Perform cyber defense trend analysis and reporting.
• Perform event correlation to gain situational awareness and assess attack effectiveness.
• Provide daily summaries of network events relevant to cyber defense practices.
• Analyze identified malicious activity to determine weaknesses exploited and methods used.
• Assist in constructing signatures for cyber defense tools against new threats.

Skills

Intrusion detection

Packet-level analysis

Network traffic analysis

Incident handling

Python programming

Threat detection

Trend analysis

Education

B.S. in CS/Cyber Security/CE or related

Tools

Snort

SiLK

Job description

Title: Network Based Systems Analyst II

Description:
Solutions³ LLC is supporting our prime contractor and their U.S. Government customer on a large mission critical development and sustainment program for on and offsite incident response to Government agencies and critical infrastructure owners who experience cyber-attacks. Solutions³ LLC provides advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation, using host and network-based cybersecurity analysis capabilities.

Solutions³ LLC is seeking a Cyber Network Defense Analysts (CNDA) to support this critical mission by performing investigations to characterize the level of severity of breaches and developing mitigation/remediation plans.

Eligibility:

• Must be aUS Citizen
• Must have anactive TS/SCIclearance
• Must be able to obtainDHS Suitabilityprior to starting employment
• 2+ years of directly relevant experience in cyber defense analysis using leading edge technologies and industry standard cyber defense tools

Responsibilities Include:

• Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources
• Coordinate with enterprise-wide cyber defense staff to validate network alerts
• Document and escalate incidents (including event's history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment
• Perform cyber defense trend analysis and reporting
• Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack
• Provide daily summary reports of network events and activity relevant to cyber defense practices
• Receive and analyze network alerts from various sources within the enterprise and determine possible causes of alerts
• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities
• Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity
• Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information
• Identify and analyze anomalies in network traffic using metadata
• Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools
• Identify applications and operating systems of a network device based on network traffic
• Reconstruct a malicious attack or activity based off network traffic
• Identify network mapping and operating system (OS) fingerprinting activities
• Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the network environment or enclave

Required Skills:

• Experience successfully developing and deploying signatures
• Experience detecting host and network-based intrusions via intrusion detection technologies (e.g., Snort)
• Experience implementing incident handling methodologies
• Experience implementing protocol analyzers
• Experience collecting data from a variety of cyber defense resources
• Experience reading and interpreting signatures (e.g. snort)
• Experience performing packet-level analysis
• Experience conducting trend analysis

Desired Skills:

• Python programming experience
• Strong math and science background
• Experience with Carnegie Mellon SiLK tool suite

Desired Certifications:

• One or more of the following professional certifications: GNFA, GCIH, GCIA, GSEC, CASP+, CySA+, PaLMS, FedVTE
• GSEC (SANS401), Arcsight (or other SEIM solution), Network+, Security+

Required Education: Bachelor of Science in Computer Science, Cyber Security, Computer Engineering, or related degree; or High School Diploma and 4+ years of network investigations experience