Cyber Protection Brigade Information Technology Cybersecurity Specialist

U.S. Army Cyber Command; Richmond Hill (GA); On-site; USD 60,000 - 100,000; Full time

Job summary

Join a premier cyber protection brigade dedicated to defending against advanced cyber threats. As a Host Analyst, you will utilize your expertise in cybersecurity and forensics to hunt for adversaries, analyze host systems, and implement robust security measures. This role offers the opportunity to work within a cohesive team of specialized professionals, driving impactful cyberspace operations. If you are passionate about protecting critical infrastructure and eager to make a difference in national security, this position is perfect for you. Embrace the challenge and be part of a mission that matters.

Benefits

Health insurance

Retirement plan

Paid time off

Training and development opportunities

Flexible work hours

Tuition assistance

Life insurance

Employee assistance program

Qualifications

• Experience in cybersecurity and system/server forensics is essential.
• Knowledge of network traffic analysis and threat mitigation required.

Responsibilities

• Conduct in-depth analysis of host systems for malicious activity.
• Install and secure operating systems and hardware.
• Develop countermeasures against cyber threats.

Skills

Cybersecurity

Forensics

Incident Response

Threat Mitigation

Network Security

Operating Systems (Windows/Linux)

Data Analysis

Problem Solving

Communication

Education

Bachelor's Degree in Information Technology or related field

Relevant certifications (e.g., CompTIA Security+, CISSP)

Tools

Security Information and Event Management (SIEM) tools

Network monitoring tools

Forensic analysis tools

Job description

Organization

U.S. Army Cyber Command

Duty Location

FORT EISENHOWER, RICHMOND, GA

Major Duties

The U.S. Army Cyber Protection Brigade (CPB), also known as the "Hunter" brigade, is the Army's premier cyber threat hunter. We hunt advanced adversaries to enable information advantage in multi-domain operations and maintain and defend strategic cyber infrastructure. We are comprised of 1,300-plus specially trained and mission-focused Soldiers and civilians who work as a cohesive team to drive cyberspace operations and impose cost on our nation's enemies.
The incumbent will serve as a Host Analyst for a U.S. Army Cyber Protection Team (CPT) in the U.S. Army Cyber Protection Brigade (CPB). The incumbent will have knowledge of system/server and host-based forensics to enable cyber security operations. The cyber role of a Host Analyst performs hunt, clear, enable hardening, as well as provide Cyber Threat Emulation (CTE) and Discovery and Counter-Infiltration (D&CI) capabilities.

• Install, operate, maintain, configure, test, and secure hardware and software-based Operating Systems (OS).
• Conduct in-depth analysis of host systems and servers for indicators of Malicious Cyber Activity (MCA), Insider Threat, or lack of best practices of Defensive Cyber Operations.
• Review host scan results to provide guidance, hardening recommendations, and system configuration best practices which enable local network/system owners to secure their environment against Malicious Cyber Activity (MCA).
• Recognize and/or develop signatures to identify indicators of compromise on client host systems/servers.
• Perform triage procedures on potentially malicious systems within mission parameters.
• Clear and defend critical assets, Mission Relevant Terrain (MRT) or Key Terrain - Cyber (KT-C) either remotely or by deploying to the affected location as needed.
• Develop Army/Department of Defense countermeasures, threat/vulnerability analysis, operational assessment and threat mitigation.
• Coordinate with local defenders and cybersecurity service providers (CSSPs) to develop methods for the timely and accurate reporting and implementation of recommended defensive countermeasures.

Qualifications/ Specialized Experience

In order to qualify, you must meet the education and/or experience requirements described below for each applicable grade level you wish to be considered. Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community; student; social). You will receive credit for all qualifying experience, including volunteer experience. Your resume must clearly describe your relevant experience; if qualifying based on education, your transcripts will be required as part of your application. Additional information about transcripts is in this document. To qualify based on your experience, your resume must describe one year of specialized experience that demonstrates the possession of knowledge, skills, abilities, and competencies necessary for immediate success in the position. Such experience is typically in or directly related to the work of the position to be filled. Specialized experience would be demonstrated by:

GG-07: Assisting in performing surveys and evaluating network traffic to identify baselines, trends, anomalous traffic, and potential malicious cyberspace activities; and assisting in incident response process and threat mitigation and development of mitigations and threat counter measures.

GG-09: Updating security patches in compliance with Cybersecurity policy/ regulations; and collecting information from customers to be used in the restoration of network services.

GG-11: Detecting anomalies in host data; monitoring enterprise tools for potential intrusions; and mitigating threats by keeping tools up to date with the latest approved system and security releases.

GG-12: Installing, operating, maintaining, configuring, testing, and/or securing hardware and software-based operating System (OS) environments (for example Microsoft Windows and Linux); analyzing network or host data and devices to recognize anomalous behavior/artifacts; determining the stage(s) of an intrusion (for example using network and/or host artifacts, along with possible use of software, to determine what stage of the cyber kill chain that a potential adversary is in); and creating threat reporting and/or briefing based on analysis. The specialized experience must include, or be supplemented by, information technology related experience (paid or unpaid experience and/or completion of specific, intensive training, as appropriate) which demonstrates each of the four competencies, as defined:

(1) Attention to Detail - Is thorough when performing work and conscientious about attending to detail.

(2) Customer Service - Works with clients and customers to assess their needs, provide information or assistance, resolve their problems, or satisfy their expectations.

(3) Oral Communication - Expresses information effectively, taking into account the audience and nature of the information.

(4) Problem Solving - Identifies problems; determines accuracy and relevance of information; uses sound judgment to generate and evaluate alternatives, and to make recommendations.

Conditions of Employment

• Appointment to this position is subject to a three year probationary period unless the appointee has previously met the requirements as described in Department of Defense Instruction 1400.25 Version 3005, Cyber Excepted Service, Employment and Placement.
• Must be able to obtain and maintain TOP SECRET eligibility with access to Sensitive Compartmented Information (SCI).
• This position is classified as Information Technology access level IT-I (Privileged User).
• Must successfully pass urinalysis screening for illegal drug use prior to appointment and periodically thereafter.
• May be required to successfully complete an initial and periodic Counter Intelligence-scope Polygraph (CI Poly) examination.
• Personnel assigned to work in a National Security Agency (NSA) facility must be able to obtain and maintain access to NSA facilities and networks.
• Duties of this position may entail alternative work schedules (AWS) such as variable or MAXIFLEX, including extended shifts; 24/7 rotating shifts, nights, weekends, and/or holidays as required.
• Temporary duty travel (TDY) may be required up to 30% annually.

Additional Information

• If you are a current federal career/career-conditional employee, you will be placed on an excepted appointment.
• Male applicants born after December 31, 1959, must complete a Pre-Employment Certification Statement for Selective Service Registration.
• You will be required to provide proof of U.S. Citizenship.
• Direct Deposit of Pay is required.
• Must be able to obtain and maintain a Top-Secret security clearance.
• Incumbent must be able to obtain (within 6 months of appointment) and maintain the proper and current Information Assurance certification.
• This is a(n) Digital Technology Career Field position.
• Multiple positions may be filled from this announcement.

Equal Opportunity Employer - The United States government does not discriminate in employment based on race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, military service or other non-merit factor.