Lead, Advanced Cyber Analytics & Countermeasures

CACI International; St. Louis (MO); On-site; USD 90,000 - 190,000; Full time

Job summary

CACI International Inc is seeking an Advanced Cyber Analytics Lead to guide the defense analytics program within Focused Operations. You will develop and maintain countermeasures and coordinate with incident response to prevent and eradicate compromises.

The role requires TS/SCI, 8+ years in cyber analytics, and DoD 8140/8570 IAT Level III. You will mentor teammates, document analyses, and participate in purple team exercises to stay ahead of adversaries.

Qualifications

• Must be a US citizen with TS/SCI clearance.
• 8+ years of advanced cyber security analytics experience.
• Certification compliant with DoD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Analyst.
• Experience with data mining or building queries in a SIEM.
• Strong understanding of signature development and tuning.
• Strong understanding of network protocols and analysis with protocol analyzers.
• Knowledge of static file signatures, i.e. "magic numbers".
• Excellent written and verbal communication.
• Desirable: hex editor proficiency; scripting in Python/ Bash/ PowerShell.

Responsibilities

• Lead the Advanced Cyber Analytics Team within Focused Operations to develop and maintain countermeasures.
• Analyze trends in NGA networks to identify events and develop or tune rules/signatures/scripts.
• Coordinate with Defensive Cyber Operations, Focused Operations, and other teams to investigate sources of compromise and refine rules.
• Collaborate with the Cyber Data Analytics team to improve SIEM alert efficiency and reduce false positives.

Skills

US Citizenship

Active TS/SCI

IAT Level III & CSSP Analyst

Data mining / SIEM queries

Signature development & tuning

Network protocol analysis

Regex proficiency

Education

DoD 8140.01 / 8570.01-M related certs

Tools

Python

PowerShell

Bash

Hex editor

Job description

CACI International Inc is seeking an Advanced Cyber Analytics Lead to guide the defense analytics program within Focused Operations. You will develop and maintain countermeasures and coordinate with incident response to prevent and eradicate compromises.

The role requires TS/SCI, 8+ years in cyber analytics, and DoD 8140/8570 IAT Level III. You will mentor teammates, document analyses, and participate in purple team exercises to stay ahead of adversaries.