Senior Cyber Defense Analyst with Secret Clearance

CALNET, Inc.; Fort Bragg (NC); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

401(k)

Job summary

CALNET, Inc. is seeking a Senior Cyber Defense Analyst to provide 24/7/365 Blue Team services for cyberspace security on NIPRNet and SIPRNet at Fort Bragg, NC. The role involves analyzing security events, maintaining SIEM rules, and coordinating with ARCYBER for defense operations.

The candidate should have a US Citizenship, a Secret clearance, and 5+ years of IT infrastructure experience. Fort Bragg availability offers a challenging environment with robust DoD cyber defense practices.

Qualifications

• Bachelor’s Degree in IT or related field (preferred).
• U.S. Citizenship and Secret Clearance is required.
• 5+ years IT infrastructure experience.

Responsibilities

• Provide 24/7/365 Blue Team services for cyberspace security on NIPRNet and SIPRNet.
• Maintain and update SIEM correlation rules and detection logic.
• Conduct continuous monitoring using SIEM and analytics tools.
• Coordinate with ARCYBER and RCC for signature deployment and configurations.
• Ensure incident response actions are executed promptly to mitigate threats.

Skills

Network Security Monitoring

SIEM

Incident Response

Threat Analysis

Education

Bachelor’s Degree in IT or related field

Tools

Elastic SIEM

Trellix ENS

Snort

Suricata

Zeek

Job description

Founded in 1989, CALNET, Inc. has become one of the fastest growing privately held companies in the Technology, Intelligence Analysis, and Language Services consulting arena. Headquartered in Reston, VA, CALNET employees deliver true value to our customers by employing best practices, world-class technologies industry expertise in every project. CALNET is ISO 9001, ISO 20000, and CMMI-Level III certified

For a USARC - Defensive Cyberspace Operations opportunity, we are currently searching for a talented Senior Cyber Defense Analyst in Fort Bragg, NC to join our team.

About The Job

In this position you will provide 24/7/365 Blue Team services for Cyberspace Security Incident Investigation and Mitigation on both NIPRNet and SIPRNet supported networks. Blue Team operations comprise the primary operational layer of the DCO mission. You shall perform all Blue Team functions IAW CJCSM 6510.01B, AR 25-2, the current ARCYBER and supported RCC TTPs/SOPs, and the current DoD Cybersecurity Services Evaluator Scoring Matrix. You will ingest, correlate, and analyze sensor and host data from across the supported enterprise (historical baseline: approximately 410 sensor feeds producing in excess of 800 events per second, approximately 500 million security events per week) and shall scale staffing and tradecraft to maintain operational tempo at or above these volumes.

Job Requirements

• Network Security Monitoring and Event Analysis.
  • Conduct continuous monitoring using the enterprise SIEM platform (currently Elastic SIEM, or successor as designated by the Government) and supporting big-data analytics and detection tooling.
  • Analyze and correlate anomalous events across SIEM, host-based security (Trellix ENS or successor), endpoint detection (Tychon or successor), full packet capture (PCAP), NetFlow, IDS/IPS (Snort, Suricata, Sourcefire, Fidelis, Zeek), forward and reverse proxy logs, router/firewall syslog, and JRSS-equivalent boundary devices.
  • Perform exploratory and in-depth analysis of host-based audit logs, captured network traffic, malware artifacts, and incident report trends to characterize threats and identify Advanced Persistent Threat (APT) activity not detected via traditional means.
  • Develop, document, and refine a definable, repeatable triage process and support analytic scripts to enable consistent escalation across the analyst team.
  • Maintain and update SIEM correlation rules, watchlists, and detection logic, and coordinate signature submissions with ARCYBER signature working groups for global implementation where appropriate.
  • Incident Response and Internal Defensive Measures (IDM).
    • Execute critical blocks within two (2) hours of notification or detection (or as otherwise determined by event criticality) to mitigate ongoing threat activity within the AOR.
    • Execute immediate (within 24 hours) action steps to mitigate threats where the operational impact of delay would exceed acceptable risk.
    • Coordinate with the applicable Theater Signal Command (TSC), DoDIN-A staff, and supported RCC for network configuration changes such as IP blocking, ACL modification, and signature deployment; where the Contractor does not administratively control the sensor grid, submit internal defensive measure recommendations (with operational impact analysis and risk justification) to the appropriate Configuration Control Board (CCB) or Designated Approving Authority
    • Capture and perform initial analysis of volatile data, log data, and captured network traffic; maintain incident chain of custody IAW ARCYBER F&MA procedures and coordinate shipment of original forensic evidence to ARCYBER F&MA for imaging when required.
    • Maintain quality control of incident records to ensure CJCSM 6510.01B compliance, conduct incident trend analyses, and ensure all investigation data is fed to the designated ARCYBER incident-handling portal with the most current action visible.

Required Skills

• Bachelor’s Degree in an IT field preferred
• U.S Citizenship and Secret Clearance is required.
• 5+ years’ IT Infrastructure experience

This opportunity is in Fort Bragg, NC

CALNET, Inc. offers a competitive salary and a generous benefits package. This package includes medical, dental, vision, life, short- and long-term disability insurances, a 401(k)-retirement savings plan, and generous leave time.

CALNET, Inc. is an Equal Opportunity Employer. EEO/M/F/D/V