Cybersecurity Analyst

Saic; San Antonio (TX); On-site; USD 110,000 - 170,000; Full time

Job summary

SAIC seeks a senior network security analyst to join the team supporting a major state & local government customer. The role emphasizes Armis Centrix tool administration and advanced SOC operations in a on-site setting.

As part of the Security Operations Center, you will lead incident investigations, threat analysis, and response efforts while coordinating with vendors and government counterparts to ensure secure baselines and rapid containment.

Qualifications

• BS Degree plus 5+ years of cybersecurity experience; MS with 3+ years or PhD with experience.
• US Citizen with ability to pass CJIS background and maintain CJIS clearance.
• Experience across security operations, incident response, threat analysis, and investigations.

Responsibilities

• Administer Armis Centrix tool configurations and policies.
• Serve as SOC Tier 3 analyst within a State Agency SOC.
• Perform incident response, vulnerability analysis, and investigation activities.
• Coordinate with vendors and system owners for secure baselines.
• Provide briefings to senior/state government executives.
• Utilize threat intel to assess campaigns and response levels.
• Gather evidence for legal proceedings or government use.

Skills

US Citizenship

CJIS background

Security operations

Education

BS Degree

MS Degree

PhD

Tools

Armis 201+ certifications

ITIL v4

CEH

GCIH

CASP

GSP

BTL2

Job description

Description

Science Applications International Corporation (SAIC) is seeking a senior network security analyst to join our team supporting a major state & local government customer. This position reports to the Security Director. This is an on-site role to act as an analyst and tool admin for Armis.

Essential duties of this position include:

• Hybrid role as an Armis Centrix tool admin and SOC Tier 3, with the potential to be required to support Security Incident Response Team operations.
  • Supports dedicated work functions for state government agency.
  • Own and manage baseline configurations, policies, and implementation of front-end operations for Armis.
  • Work with Armis as a vendor for architecture and engineering implementation concerns.
• Performs network security, cybersecurity defense & analysis, incident response, threat analysis, exploitation analysis, vulnerability analysis, and incident investigations.
• Work is performed in a State Agency managed Security Operations Center (SOC).
• Duties are primarily categorized as Tool Admin and Analyst, Incident Investigation and Response, Security Operations, Incident Management, or similar roles.
• Utilizes COTS/GOTS applications, ticketing systems, lab systems, forensic applications, and/or custom tools, techniques, and procedures (TTPs) to monitor systems for abnormal events and determine if events are to be deemed an incident.
• Determines if incidents are due to malicious or suspicious actions by one or more threat actors.
• Utilizes threat intelligence to determine if the incident is part of a named campaign to determine appropriate levels of response, or provide new intelligence based on investigative actions to threat intelligence teams, organizations, and/or external parties.
• Obtains information and evidence for legal proceedings or to provide to government counterparts for possible military, law enforcement, and/or counter-intelligence response actions/activities, Human Resources investigations, and/or management action.
• Works with system owners to restore affected systems to secure baseline configurations.
• Coordinates with contracted vendors for incident control.
• Researches, evaluates, and recommends new security tools, techniques, and technologies.
• Supports cyber metrics development, maintenance, and reporting for managed tools.
• Provides briefings to senior staff and/or state government agencies executive staff.

Qualifications

Required Education and Qualifications:

• BS Degree and five (5) years or more experience; Masters and three (3) years or more experience; PhD and 0 years related experience
• Complete understanding and wide application of technical principles, theories, and concepts in the cybersecurity field.
• Ability to receive assignments in the form of objectives and establish goals to meet outlined objectives.
• General knowledge of related IT disciplines.
• Candidates must be a US Citizen and be able to pass a CJIS Criminal Justice background investigation and maintain CJIS clearance throughout employment term.

Required Experience

• Providing technical solutions to a wide range of difficult problems requiring the analysis of identifiable factors.
• Independent determination and development of approaches to solutions with work reviewed upon completion for adequacy in meeting objectives.
• Demonstrating good judgment in selecting methods and techniques for obtaining solutions.
• Contributing to the completion of specific programs and projects within the government contracting space.
• Security+ or higher certifications
• Armis 201 or higher class certifications.

Preferred Experience:

• ITIL v4 certification preferred (Foundation or above)
• CEH, GCIH, BTL2, CASP, or GSP
• Providing technical solutions to a wide range of difficult problems requiring the analysis of identifiable factors.
• Independent determination and development of approaches to solutions with work reviewed upon completion for adequacy in meeting objectives.
• Demonstrating good judgment in selecting methods and techniques for obtaining solutions.
• Contributing to the completion of specific programs and projects.