Cyber Technical Intelligence Analyst

City of New York; New York (NY); Hybrid; USD 100,000 - 125,000; Full time

Benefits offered by this job

Remote-friendly policy

Job summary

The City of New York's Department of Buildings is seeking a Cyber Technical Intelligence Analyst to augment threat management, conduct intel analysis, and coordinate with NYC Cyber Command and the Office of Technology & Innovation Info Sec.

You will perform malware analysis, threat hunting, and threat intel dissemination across DOB's IT environment, with a hybrid remote work option up to two days per week and a focus on incident response and risk reduction.

Qualifications

• Bachelor's degree and four years of satisfactory full-time experience related to projects and policies required by the particular position; or educational equivalent.
• Equivalent education/experience accepted in lieu of degree.

Responsibilities

• Provide intel support and assist or execute investigative efforts or tasks.
• Assist hunt missions to augment detection capabilities across DOB’s IT environment.
• Disseminate tactical intelligence (IOCs) and finished reports.
• Develop and execute threat and risk communication processes.

Skills

Threat analysis

Incident response

Network monitoring

Threat hunting

Education

Baccalaureate degree

Tools

PowerShell

Python

Power Automate

Microsoft Graph API

Job description

• Salary Band: $100,000 to $125,000
• Compensation: USD 75,000 - USD 109,538

Job Description

The NYC Department of Buildings (DOB) is responsible for ensuring the safe and lawful use of buildings and properties by enforcing the NYC Construction Codes, Energy Code and Zoning Resolution. We facilitate compliant development with integrity, efficiency and professionalism. DOB is committed to becoming a premier municipal building organization, dedicated to enhancing the quality of life for all New Yorkers and making our city safer. We are committed to improving our performance and developing procedures that are streamlined, understandable and transparent. We are seeking a Cyber Technical Intelligence Analyst. Cyber Technical Intelligence Analyst will perform critical functions within the Threat Management discipline by consuming and analyzing tactical and technical intel, as well as coordinating between New York City Cyber Command and Office of Technology & Innovation Info Sec. Duties and Responsibilities include but not limited to the following:

• Provide intel support and directly assist or execute investigative efforts or tasks;
• Assist hunt missions to augment detection capabilities to identify threats across DOB’s IT operating environment;
• Responsible for the collection, processing, analysis, and dissemination of tactical intelligence (IOC’s) and products (finished reports)
• Develop, maintain, and execute threat and risk communication processes
• Perform network, system, and kill chain analysis on how malware was introduced and propagated;
• Conduct research for tracking certain code families, campaigns, or actors through technical analysis of data, malicious codes, and infrastructure;
• Employ predictive analytic methods to determine changes in adversary’s capabilities, motivations, and intent, while providing recommendations to reduce risk before exposure to threats occur;
• Characterize and analyze network traffic and server/cloud performance metrics to identify anomalous activity and potential threats;
• Resolve New York City Cyber Command’s Security Operations Center remediation requests
• Provide direct analytic support, threat hunting, detection engineering to the Security Operations Center, including Incident Response and Risk Analysts, to add context to active investigations and threats using intelligence;
• Follow up on incident reports and app scan reports to ensure that proper mitigation is taking place in timely manner;
• Investigate suspicious traffic and identify potential attacks, false positives, and missed detections
• Conduct network monitoring and intrusion detection analysis using various computer network defense tools, such as intrusion detection/prevention systems, firewalls and host-based security systems; review and adjust ACL as needed based on source/destination/port by requirement;
• Conduct log-based and endpoint-based threat detection to detect and protect against threats coming from multiple sources;
• Correlate activity across assets (endpoint, network, apps) and environments (on-premises, cloud) to identify patterns of anomalous or suspicious activity;
• Support the creation of business continuity/disaster recovery plans, including conducting disaster recovery tests, publishing test results and making changes necessary to address deficiencies;
• Research emerging threats and vulnerabilities to aid in the identification of incidents;
• Provide users with incident response support, including mitigating actions to contain activity and facilitating forensic analysis when necessary;
• Design, implement, audit, and maintain ThreatLocker policies
• Manage ThreatLocker Application Whitelisting, Ringfencing, Storage Control, and Elevation Control
• Use scripting and automation tools, including PowerShell, Python, Power Automate, and Microsoft Graph API, to improve mobile service capabilities.
• Subject matter expert in mobile (MDM) architecture, device management, and security.
• Create and present custom threat briefing materials for tactical situational awareness;
• Handle special projects and initiatives as assigned.

REMOTE WORK

This position may be eligible for remote work up to 2 days per week, pursuant to the Remote Work Pilot Program.

Qualifications

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required by the particular position; or,

Education and/or experience which is equivalent to "1" above.

Additional Information

The City of New York is an inclusive equal opportunity employer committed to recruiting and retaining a diverse workforce and providing a work environment that is free from discrimination and harassment based upon any legally protected status or protected characteristic, including but not limited to an individual's sex, race, color, ethnicity, national origin, age, religion, disability, sexual orientation, veteran status, gender identity, or pregnancy.