Cyber Security Analyst

Bespoke Technologies, Inc.; Chantilly (VA); On-site; USD 110,000 - 170,000; Full time

Job summary

Bespoke Technologies, Inc. in Chantilly, VA, is seeking a Cyber Security Analyst to bolster the Sponsor's cybersecurity posture across systems and applications. You will analyze security data, support accreditation efforts, and guide incident response activities.

The role requires hands-on expertise in SIEM, cloud security, vulnerability management, and security controls, with the ability to develop playbooks and communicate risk to stakeholders.

Qualifications

• Demonstrated experience with real-time prevention, detection, and remediation of cyberattacks on internet-facing systems.
• Experience in offensive (pentesting/red team) or defensive (SOC/IR/threat hunting) cyber operations.
• Scripting in Python/PowerShell/Bash for automation and analysis.
• Experience with SIEMs (Splunk/QRadar/Elastic Stack).
• Experience with AWS cloud logging (CloudTrail/CloudWatch).
• Knowledge of network protocols, packet capture, and netflow analysis.
• Understanding of OSes (Windows/Linux) and cloud environments (AWS/Azure/GCP).
• Experience with attack vectors and defensive countermeasures.
• Experience with A&A packages and security approvals.
• Ability to review assessment reports and develop mitigations (POA&Ms).
• Experience ensuring continuous monitoring and compliance of systems.
• Experience drafting SSPs and security requirements (A&A).
• Experience writing/reviewing NIST 800-53 controls.
• Experience running Rapid7 scans.
• Experience with AWS cloud security.
• Experience with Tableau for dashboards.
• Capable of working independently and in team environments.

Responsibilities

• Deliver improvements to cybersecurity posture through analysis and reporting of security data.
• Design, implement, and optimize security monitoring to detect threats.
• Lead and participate in cyber incident response (investigation, containment, eradication, recovery).
• Develop and refine incident response playbooks and procedures.
• Conduct comprehensive vulnerability assessments and penetration tests to identify weaknesses.
• Evaluate the effectiveness of existing security controls on Sponsor systems.
• Provide guidance on security system design and implementing controls and technologies.
• Perform deep dive analytics to inform network engineering decisions.
• Ensure Sponsor systems are secured and accredited with required approvals.
• Create and maintain documentation for accreditation.
• Track actions related to accreditation and report status to stakeholders.
• Leverage AI to support security investigations.
• Overwatch and monitor per Sponsor policies.
• Analyze security data to identify issues and inform remediation steps.
• Maintain documentation of incidents, vulnerabilities, and mitigations.
• Educate Sponsor teams on cybersecurity best practices.
• Contribute to cyber policies, standards, and procedures.
• Support data collection, evaluation, and publication in documents and reports.
• Develop methods to track and report cybersecurity metrics for management.

Skills

Real-time cyber defense

Offensive/defensive cyber ops

Scripting (Python/PowerShell/Bash)

SIEM (Splunk/QRadar/Elastic)

AWS Cloud logging (CloudTrail/CloudW

Network analysis (packet capture/netflo

Windows/Linux OS & cloud (AWS/Azure/G

Attack vectors & countermeasures

A&A packages & security approvals

POA&M & risk mitigation

SSP & NIST 800-53 controls

Tableau data visualizations

Rapid7 scans

Tools

Tableau

Splunk

QRadar

Elastic Stack

Rapid7

Nmap

Metasploit

Job description

BT-512 Cyber Security Analyst

Location: Chantilly, VA

Introduction

The Sponsor requires support with improving the overall cybersecurity posture of the Sponsor's systems and applications. This includes support related to security, accreditation, cyber defense, cyber assurance, cyber assessment, and cyber engineering. Additionally, support is required for analyzing cybersecurity data and reporting outcomes to stakeholders in support of decisions on mitigations, remediation, and enhancements.

Work Requirements

• The Contractor Team shall deliver improvements in the overall cybersecurity posture of the Sponsor's systems and applications including analysis and reporting on security data.
• The Contractor Team shall design, implement, and optimize security monitoring solutions to detect advanced persistent threats (APTs), malware, and other cyberattacks.
• The Contractor Team shall lead and participate in cyber incident response activities, including investigation, containment, eradication, and recovery.
• The Contractor Team shall develop and refine incident response playbooks and procedures.
• The Contractor team shall conduct comprehensive vulnerability assessments and penetration tests to identify and prioritize security weaknesses.
• The Contractor Team shall evaluate the effectiveness of existing security controls on Sponsor systems and applications.
• The Contractor Team shall provide guidance on security system design and implementation to include recommending and implementing security controls, tools, and technologies to enhance defensive capabilities.
• The Contractor Team shall conduct deep dive analytics, perform assessments and audits, and inform network engineering decisions.
• The Contractor Team shall ensure all Sponsor systems are secured and accredited with the required Sponsor approval boards.
• The Contractor Team shall create and maintain the necessary documentation required for accreditation.
• The Contractor Team shall track action items related to accreditation, work with the Sponsor teams to complete the actions, and report status to the appropriate Sponsor Stakeholders.
• The Contractor Team shall leverage Artificial Intelligence (Al) as applicable to support and investigate the security of Sponsor systems and applications.
• The Contractor Team shall conduct overwatch and monitoring responsibilities in alignment with Sponsor's policies.
• The Contractor Team shall conduct analysis on the Sponsor's system and application security data to identify issues and inform remediation steps and mitigations.
• The Contractor Team shall maintain accurate and detailed documentation of security incidents, vulnerabilities, and mitigation strategies.
• The Contractor Team shall educate Sponsor teams on cybersecurity best practices.
• The Contractor Team shall contribute to the development and refinement of cybersecurity policies, standards, and procedures.
• The Contractor Team shall support tasks requiring collecting, compiling, evaluating, and publishing information and statistical data included in documents, records, forms, reports, plans, policies, and regulations.
• The Contractor Team shall develop methods for tracking, monitoring, and reporting cyber-security-related metrics for Sponsor management consumption and use.

Required Skills And Demonstrated Experience

• Demonstrated experience (significant and current) on real-time prevention, detection, and remediation of cyberattacks on internet-facing systems.
• Demonstrated experience in either offensive (e.g., penetration testing, red teaming, ethical hacking) or defensive (e.g., security operations, incident response, threat hunting) cyber operations.
• Demonstrated experience (proficiency) in scripting languages (e.g., Python, PowerShell, Bash) for automation and analysis.
• Demonstrated experience with security information and event management (SIEM) systems (e.g., Splunk, QRadar, Elastic Stack)
• Demonstrated experience with AWS cloud logging such as CloudTrail and CloudWatch.
• Demonstrated experience with network protocols, packet capture analysis, and netflow analysis.
• Demonstrated experience with security event log analysis, including Windows event logging and Syslog.
• Demonstrated understanding of network protocols, operating systems (Windows, Linux), and cloud environments (AWS, Azure, GCP).
• Demonstrated experience with various attack vectors, exploitation techniques, and defensive countermeasures.
• Demonstrated experience with Authority and Accreditation (A&A) packages needed to obtain security approvals for system deployments into production state.
• Demonstrated experience reviewing assessment reports and assist projects in identifying security risks, including technical and non-technical, and developing effective mitigation strategies, including Plan of Action and Milestones (POA&Ms).
• Demonstrated experience assuring system components and software applications adhere to continuous monitoring and compliance with Security accesses and controls.
• Demonstrated experience reviewing and authoring System Security Plans (SSP), security requirements, and other supporting documentation for the A&A process.
• Demonstrated experience writing and reviewing NIST 800-53 controls.
• Demonstrated experience running and interpreting Rapid7 scans.
• Demonstrated experience working with Amazon Cloud security.
• Demonstrated experience with data visualizations tools (e.g. Tableau) to support development of visual dashboards to assist stakeholders with overwatch/monitoring of systems.
• Demonstrated experience working effectively independently and as part of a team in a fast-paced environment.

Highly Desired Skills And Demonstrated Experience

• Demonstrated experience with knowledge of information security standards such as ISO 27001 and NIST.
• Demonstrated experience with the ability to design, implement and maintain IDS/IPS technologies (Intrusion Detection System/Intrusion Prevention System).
• Demonstrated experience with common offensive security tools and methodologies (e.g., Metasploit, Nmap, Burp Suite, Cobalt Strike).
• Demonstrated experience processing software applications through the Sponsor's approving channels to operate within the Sponsor's Cloud offerings.
• Demonstrated experience working in a Customer-facing environment.
• Demonstrated experience with Sponsor security policies and guidelines.
• Demonstrated exceptional analytical and problem-solving skills with the ability to dissect complex technical issues and propose effective solutions.
• Demonstrated experience working in the Sponsor's secure cloud computing environment.
• Certifications; OSCP, GIAC, CEH, BCPen, CompTIA CySA+, PenTest+, (ISC)2 CISSP, or CSSLP.