Cyber Technical Intelligence Analyst

Cityofnewyork; New York (NY); Hybrid; USD 90,000 - 130,000; Full time

Job summary

The City of New York is seeking a Cyber Technical Intelligence Analyst to join the DOB cyber program in New York, NY. The role focuses on intel support, threat hunting, and incident response across the IT environment, using telemetry from endpoints, networks, and cloud services to identify and mitigate threats.

Responsibilities include collecting and analyzing indicators of compromise, developing threat communications, and supporting remediation in the Security Operations Center.

Qualifications

• Bachelor's degree or equivalent plus 4 years of related experience
• Experience in cyber intel, threat analysis, and incident response
• Familiarity with network, endpoint, and cloud security
• Ability to create threat intelligence reports and briefings

Responsibilities

• Provide intel support and assist investigative efforts
• Augment detection capabilities through hunt missions
• Analyze IOC(S) and produce finished reports
• Develop threat and risk communication processes
• Perform network, system, and kill chain analyses of malware
• Research campaigns, actors, and code families through data analysis
• Use predictive analytics to assess adversary capabilities and intent
• Characterize network traffic and identify anomalous activity
• Support SOC remediation requests and incident response
• Create and present threat briefings for tactical awareness
• Handle special projects as assigned

Skills

Threat intelligence

Incident response

Threat hunting

Security monitoring

Education

Baccalaureate degree or equivalent

Tools

PowerShell

Python

Power Automate

Microsoft Graph API

IDS/IPS

Job description

The NYC Department of Buildings (DOB) is responsible for ensuring the safe and lawful use of buildings and properties by enforcing the NYC Construction Codes, Energy Code and Zoning Resolution. We facilitate compliant development with integrity, efficiency and professionalism. DOB is committed to becoming a premier municipal building organization, dedicated to enhancing the quality of life for all New Yorkers and making our city safer. We are committed to improving our performance and developing procedures that are streamlined, understandable and transparent.

We are seeking a Cyber Technical Intelligence Analyst.

Cyber Technical Intelligence Analyst

• Provide intel support and directly assist or execute investigative efforts or tasks;
• Assist hunt missions to augment detection capabilities to identify threats across DOB's IT operating environment;
• Responsible for the collection, processing, analysis, and dissemination of tactical intelligence (IOC's) and products (finished reports)
• Develop, maintain, and execute threat and risk communication processes
• Perform network, system, and kill chain analysis on how malware was introduced and propagated;
• Conduct research for tracking certain code families, campaigns, or actors through technical analysis of data, malicious codes, and infrastructure;
• Employ predictive analytic methods to determine changes in adversary's capabilities, motivations, and intent, while providing recommendations to reduce risk before exposure to threats occur;
• Characterize and analyze network traffic and server/cloud performance metrics to identify anomalous activity and potential threats;
• Resolve New York City Cyber Command's Security Operations Center remediation requests
• Provide direct analytic support, threat hunting, detection engineering to the Security Operations Center, including Incident Response and Risk Analysts, to add context to active investigations and threats using intelligence;
• Follow up on incident reports and app scan reports to ensure that proper mitigation is taking place in timely manner;
• Investigate suspicious traffic and identify potential attacks, false positives, and missed detections
• Conduct network monitoring and intrusion detection analysis using various computer network defense tools, such as intrusion detection/prevention systems, firewalls and host-based security systems; review and adjust ACL as needed based on source/destination/port by requirement;
• Conduct log-based and endpoint-based threat detection to detect and protect against threats coming from multiple sources;
• Correlate activity across assets (endpoint, network, apps) and environments (on-premises, cloud) to identify patterns of anomalous or suspicious activity;
• Support the creation of business continuity/disaster recovery plans, including conducting disaster recovery tests, publishing test results and making changes necessary to address deficiencies;
• Research emerging threats and vulnerabilities to aid in the identification of incidents;
• Provide users with incident response support, including mitigating actions to contain activity and facilitating forensic analysis when necessary;
• Design, implement, audit, and maintain ThreatLocker policies
• Manage ThreatLocker Application Whitelisting, Ringfencing, Storage Control, and Elevation Control
• Use scripting and automation tools, including PowerShell, Python, Power Automate, and Microsoft Graph API, to improve mobile service capabilities.
• Subject matter expert in mobile (MDM) architecture, device management, and security.
• Create and present custom threat briefing materials for tactical situational awareness;
• Handle special projects and initiatives as assigned.

REMOTE WORK

This position may be eligible for remote work up to 2 days per week, pursuant to the Remote Work Pilot Program.

EDUCATION

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position; or,

Education and/or experience which is equivalent to "1" above.

The City of New York is an inclusive equal opportunity employer committed to recruiting and retaining a diverse workforce and providing a work environment that is free from discrimination and harassment based upon any legally protected status or protected characteristic, including but not limited to an individual's sex, race,