Senior Security Analyst

Linuxconfig; Seattle, Northern (WA, KY); Hybrid; USD 80,000 - 90,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k) with match

Employee stock purchase program

Paid time off and holidays

Parental leave

Transit/commute benefits

Job summary

BlackSky, a real-time intelligence company, seeks a Senior Security Analyst to join the Security Analysis Team. You will monitor, defend, and secure the enterprise using SIEM, CTI, and DFIR activities across Linux, Windows, and cloud environments.

You will work with a distributed team in Herndon, VA and Seattle, WA, performing threat hunting, incident response, and vulnerability remediation while contributing to automation and security posture improvements.

Qualifications

• 7+ years in security analyst/DFIR.
• Experience with security monitoring and incident response.
• Ability to document processes and results for peers.

Responsibilities

• Perform security monitoring and DFIR across environments.
• Review CTI and apply insights to secure the enterprise.
• Conduct threat hunting across environments.
• Document procedures for ad-hoc processes and forensics.
• Support vulnerability management and remediation with IT/Product owners.
• Develop automation to improve detection and response timelines.
• Complete compliance assessments and report findings.

Skills

DFIR

Incident response

Threat hunting

Linux security

Security monitoring

Education

CISSP

GCIH

CHFI

GCFE

GCFA

Tools

EDR

CASB

Linux

Windows

MacOS

Job description

BlackSky is a real-time intelligence company. We own and operate the world's most advanced space-based intelligence platform and provide customers satellite imagery, automated analytics and high-frequency monitoring of strategic locations, economic assets and events from around the globe. BlackSky is trusted by the most demanding allied military and intelligence organizations and commercial companies to deliver foresight into critical matters that affect national security and the economy. BlackSky's data enables governments and businesses to see, understand and anticipate change as it happens, giving them the ultimate strategic advantage so they can act quickly. Our global team works with cutting-edge technology to make a difference around the world and prides itself on being people-first, customer-focused and fun.

The Senior Security Analyst position reports to the Manager of Security Analysis Team (i.e., Security Operations Center (SOC)) with rollup to the Director of Security and plays a vital role in monitoring, defending, and securing the BlackSky enterprise environment against cyber threats.

You will perform continuous monitoring of network, managed devices and identities, cloud services, business systems, and application traffic in support of BlackSky’s Security Operations Center (SOC). You will conduct analysis of these logs within an integrated Security Information and Event Management (SIEM) platform and work to develop novel searches, dashboards, and alerts to improve the SOC’s detection and response timelines. You will leverage cyber threat intelligence (CTI) reporting in conjunction with internal digital forensics and incident response (DFIR) activities to ensure BlackSky is properly positioned to defend against security threats to our enterprise networks.

The Security Team is geographically distributed across our Herndon, VA and Seattle, WA offices therefore the role can be based at either of these two locations, surrounding areas, or anywhere in the United States.

Responsibilities:

• Perform security monitoring and digital forensics and incident response (DFIR) activities across corporate, product, and mission environments by reviewing events and alerting attributed to indicators of compromise (IOCs), indicators of attack (IOAs), cyber threat intelligence (CTI) reporting, and non-compliance activities
• Review multiple sources of cyber threat intelligence and apply the insights appropriately to inform and secure the enterprise
• Conduct regular threat hunting across the corporate, product, and mission environments
• Document procedures for performance of job duties to formalize ad-hoc processes
• Conduct security analysis of data from many sources - system/event logs, network traffic, and SaaS security tools.
• Perform analysis, and digital forensics of potential malware using Industry standard Sandbox tools.
• Support continuous monitoring of network, operating system, and application log traffic to identify potential security threats related to the industry.
• Support vulnerability management process through identification and prioritization of critical security concerns in collaboration with IT or Product owners to drive vulnerability or misconfiguration remediation activities.
• Work with product owners to define offensive testing scope requirements and constraints and to support the remediation process on any identified vulnerabilities.
• Monitor operational systems for continuous compliance with hardened baseline images against industry checklists such as CIS Benchmarks and/or DISA STIGs,
• Develop solutions to automate reoccurring tasks and improve adversary detection.
• Complete compliance assessments and report findings to management.
• Document findings (anomalies, incidents, concerns) and share widely with security, IT, and product teams as appropriate to enable enhanced understanding of security posture.
• Strong Linux security background with Ubuntu, Amazon Linux, and/or CentOS preferred.
• Support security training and manage tabletop scenarios to other employees
• Support SOX/ITGC, CMMC 2.0 Level 2, NIST 800-171 r3, UK Cyber Essentials, and customer-specific compliance requirements.
• Other responsibilities as assigned.

Required Qualifications:

• A minimum of seven (7) years’ experience performing security analyst and DFIR activities.
• A minimum of seven (7) years’ experience in IT security.
• Candidates should hold at least one of the following security certifications:
  • Certified Information Systems Security Professional (CISSP),
  • GIAC Certified Incident Handler (GCIH),
  • Computer Hacking Forensic Investigator (CHFI),
  • GIAC Certified Forensic Examiner (GCFE),
  • GIAC Certified Forensic Analyst (GCFA),
  • GIAC Reverse Engineering Malware (GREM),
  • GIAC Network Forensic Analyst (GNFA),
  • GIAC Cloud Security Automation (GCSA),
  • GIAC Cloud Penetration Tester (GCPN),
  • GIAC Public Cloud Security (GPCS),
  • GIAC Security Operations Certified (GSOC),
  • GIAC Certified Detection Analyst (GCDA),
  • Access Data Certified Examiner (ACE), and/or
  • Encase Certified Examiner (EnCE), AWS Certified Security - Specialty.
• Ability to document processes, procedures, and results of technical analysis for review by peers.
• Experience with implementing, troubleshooting, and sustaining endpoint security mechanisms (e.g., EDR, CASB, and others) in at least one of the following Operating Systems - Windows, MacOS, and/or Linux.
• Experience performing at least one of the following activities - Incident Response, Digital Forensics, Malware Analysis, Network Traffic Collection, or Reverse Engineering.
• Must be a U.S. Citizen.

Preferred Qualifications:

• Endpoint Security for Windows, MacOS, and Linux environments.
• Extensive incident response, security analysis, and digital forensics experience performing event log, PCAP, and NetFlow data analysis, malware analysis, and data collection.
• Cloud Solutions: Microsoft GCC High, AWS Commercial, AWS GovCloud, VMware ESXi.
• Infrastructure as Code: AWS CloudFormation, HashiCorp Terraform.
• Knowledge of Secure DevOps Processes.
• Container Technologies: Docker, ECS, Nomad, HashiCorp product stack.

Life at BlackSky for full-time US benefits eligible employees includes:

• Medical, dental, vision, disability, group term life and AD&D, voluntary life and AD&D insurance
• BlackSky pays 100% of employee-only premiums for medical, dental and vision and contributes $100/month for out-of-pocket expenses!
• 15 days of PTO, 11 Company holidays, four Floating Holidays (pro-rated based on hire date), one day of paid volunteerism leave per year, parental leave and more
• 401(k) pre-tax and Roth deferral options with employer match
• Flexible Spending Accounts
• Employee Stock Purchase Program
• Employee Assistance and Travel Assistance Programs
• Employer matching donations
• Mac or PC? Your choice!
• Awesome swag

The anticipated base salary range for candidates in Seattle, WA and Herndon, VA is$80,000 - 90,000 per year. The final compensation package offered to a successful candidate will be dependent on specific background and education. BlackSky is a multi-state employer, and this pay scale may not reflect salary ranges in other states or locations outside of Seattle, WA.

BlackSky is committed to hiring and retaining a diverse workforce. We are proud to be an Equal Opportunity Employer. All Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, national origin, sexual orientation, gender identity, disability, protected veteran status or any other characteristic protected by law.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in BlackSky’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.