Principal Cyber Security Analyst

Navy Federal Credit Union; Pensacola (FL); On-site; USD 116,000 - 181,000; Full time

Job summary

Navy Federal Credit Union is seeking a Lead Threat Hunter to oversee advanced detection in the Cybersecurity Operations Center in Pensacola, FL. The role focuses on Windows and non-Windows environments and requires expert knowledge of APT TTPs, forensics, and incident response.

You will develop non-standard analytic queries and guide threat-hunt maturation while reporting to leadership. Responsibilities include threat hunting across enterprise data, validating detections, and collaborating with

Qualifications

• Advanced knowledge of Windows and non-Windows operating system concepts and fundamentals.
• Advanced ability to evaluate large data sets (endpoint and network events) for abnormalities.
• Advanced experience in cybersecurity and/or IT security.
• Advanced understanding of security architectures, firewalls, proxies, and network topology.

Responsibilities

• Identify and hunt for unknown threat activity using non-standard analytics across Windows and non-Windows environments.
• Lead development of requirements for test plans that support threat hunt development through adversary emulation.
• Perform threat hunts using advanced analytic techniques (e.g., event reconstruction) and report findings.

Skills

Threat hunting

Forensics

Incident response

Security analytics

Education

CISSP

CISA

CCSP

Tools

Splunk

ELK

C++

Python

IDP/IDS

SIEM

Job description

Lead threat hunting and advanced detection efforts in Navy Federal’s Cybersecurity Operations Center, with a focus on Windows and non-Windows environments.

Responsibilities

• Maintain expert knowledge of advanced persistent threat (APT) TTPs, as well as forensics and incident response practices across Windows and non-Windows platform environments
• Identify and hunt for unknown threat activity using non-standard analytics across Windows and non-Windows environments
• Lead development of requirements for test plans that support threat hunt development through adversary emulation
• Perform threat hunts using advanced analytic techniques (for example, event reconstruction), tracking suspicious processes end-to-end and extracting custom data points for reporting and findings
• Conduct advanced analysis of network and endpoint events from enterprise sources to determine event impact
• Analyze log files, forensic evidence, and related information to determine best approaches for detecting endpoint-level intrusions
• Drive the development of non-standard analytic queries that can be implemented on cyber defense tools in response to new or observed threats within the Windows and non-Windows enclave
• Support process maturation and event correlation across the enterprise to surface security architecture and logging gaps
• Examine network topologies to understand data flow patterns across the network
• Provide cybersecurity recommendations to leadership based on significant threats and vulnerabilities
• Help mature threat hunt standards, taxonomy, and processes
• Perform other duties as assigned

Requirements

• Advanced knowledge of Windows and non-Windows operating system concepts and fundamentals
• Advanced ability to evaluate large data sets (endpoint and network events) for abnormalities, including baseline analysis
• Advanced experience in cybersecurity and/or IT security
• Advanced understanding of security architectures, firewalls, proxies, and network topology
• Advanced skill in developing and deploying custom content queries
• Advanced experience using security event correlation tools such as Splunk and ELK
• Advanced capability in hunting host and network-based intrusions via intrusion detection technologies
• Outstanding communication skills to report complex technical situations to executive leadership and nontechnical staff
• Advanced research, analytical, and problem-solving skills
• Advanced ability to work with management, supervisors, stakeholders, and vendors
• Expert capability to collaborate with other teams on time-sensitive incidents
• Advanced skill in identifying gaps in technical capabilities
• Advanced skill in relevant programming languages (for example, C++, Python)
• Advanced experience testing and evaluating tools for implementation
• Advanced experience with enterprise security tools for log management, IDP/IDS, antivirus, firewalls, proxies, DLP, forensic analysis, and SIEM
• CISSP, CISA, CCSP, or other related Information Security certifications
• Advanced knowledge of IT security standards and frameworks (for example, MITRE ATT&CK)
• Advanced ability to analyze audit log events for cloud technologies to support cyber defense detection development

Technologies

• Windows
• Splunk
• ELK
• C++
• Python
• MITRE ATT&CK
• IDP/IDS
• antivirus
• firewalls
• proxies
• DLP
• SIEM

Location & Schedule

• Pensacola, FL (onsite)
• Hours: Monday - Friday, 8:00AM - 4:30PM

Additional Locations

• 820 Follin Lane, Vienna, VA 22180
• 5550 Heritage Oaks Drive, Pensacola, FL 32526
• 141 Security Dr. Winchester, VA 22602

Salary

USD 115,600 - 181,200 per year (paid within the range based on experience, location, and market position).

Overview

• Navy Federal Credit Union does not provide sponsorship for this role; applicants must be authorized to work in the United States without the need for current or future sponsorship
• The Cybersecurity Operations Center is focused on advancing the program’s strategic vision

Disclaimers & Notices

• Navy Federal reserves the right to fill this role at a higher or lower grade level based on business need
• An assessment may be required to compete for this position
• Job postings may close early or extend at the hiring team’s discretion based on qualified applicant volume
• For compensation and benefits details, review the Benefits page of the Navy Federal Career Site
• Bank Secrecy Act: remains cognizant of and adheres to Navy Federal policies, procedures, and regulations related to the Bank Secrecy Act