Subject Matter Expert I

Solutions3 LLC; Arlington (VA); On-site; USD 131,000 - 150,000; Full time

Job summary

Solutions³ LLC seeks a Subject Matter Expert with deep expertise in edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support government and critical infrastructure customers.

As a hunt and incident response SME, you will lead network-centric investigations, evaluate new capabilities, and coordinate on-site and remote engagements to characterize threats and drive remediation.

Qualifications

• 3+ years of experience related to evaluation and implementation of new cyber response or network forensic capabilities.
• Hands-on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.
• Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
• Knowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments.
• Ability to characterize and analyze network traffic to identify anomalous activity and potential threats.

Responsibilities

• Serves as a hunt and incident response SME, focusing on edge device compromises.
• Supports technology insertion teams by evaluating and integrating new network forensic capabilities.
• Assists Government leads in coordinating on-site and remote investigations.
• Interfacing with the customer onsite to clearly communicate status, findings, and recommendations.
• Analyzes network traffic and device logs to identify anomalies and threats.

Skills

Edge device expertise

Incident response

Network architecture

CND policies

Traffic analysis

Education

Bachelor’s degree in Computer Engineering/CS/Cybersecurity

Tools

Cisco

Ivanti

Palo Alto

Ciena

Juniper

Job description

Subject Matter Expert I

Solutions³ LLC provides support for on- and offsite incident response to government agencies and critical infrastructure owners who experience cyber-attacks. Solutions³ LLC delivers advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans.

Solutions³ LLC is seeking a Subject Matter Expert with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.

Salary Range

$131,000 - $150,000

Location

Arlington, VA

Job Type

Onsite

Eligibility

• Must be a US Citizen
• Must have an active TS/SCI clearance
• Must be able to obtainDHS Suitability prior to starting employment
• 10+ years of directly relevant experience

Responsibilities Include

• Serves as a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises.
• Serves as an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities.
• Assists the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.
• Assists the Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations.
• Characterizes and analyzes network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources.
• Identifies and analyzes anomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity.
• Reconstructs malicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns.
• Examines network topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities.
• Assess network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
• Determines appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions.
• Applies knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations.
• Applies knowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation.
• Leads analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.
• Provides expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities.
• Serves as a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents.
• Exercises considerable latitude in determining technical objectives and independently develops technical solutions to complex problems requiring ingenuity and creativity.
• Analyzes incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
• Advises technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists).
• Supports internal stakeholders on containment and eradication missions, on-site and remotely.
• Ensures evidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
• Assists with the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies.
• Distills analytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences.
• Documents analysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication.
• Assists in maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities.

Required Skills

• 3+ years of experience related to the evaluation and implementation of new cyber response or network forensic capabilities.
• Hands‑on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.
• Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
• Knowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments.
• Ability to:
  • Characterize and analyze network traffic to identify anomalous activity and potential threats.
  • Identify and analyze anomalies in network traffic using metadata (flow, DNS, proxy, etc.).
  • Reconstruct malicious activity based on network traffic and device logs.
• Understanding of general attack stages (reconnaissance, initial access, lateral movement, exfiltration, etc.) and how they manifest across the network.
• Understanding of system and application security threats and vulnerabilities and how they are observed in network traffic.
• Understanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior.
• Proficiency with common operating systems (e.g., Linux/Unix, Windows).
• Experience performing cyber incident response (scoping, containment, eradication, recovery) in operational environments.
• Ability to think independently, make sound decisions under pressure, and work with limited guidance.
• Superior written and oral communication skills, including the ability to clearly explain technical issues to both technical and non-technical stakeholders.
• Ability to work collaboratively across physical locations and within distributed teams.
• Skilled in identifying different classes of attacks and attack stages and translating findings into actionable recommendations.
• Rapid Network & Tapping Setup: Ability to quickly configure network TAPs, packet brokers, SPAN ports, and unmanaged/managed switches without disrupting live production or air‑gapped traffic.

Desired Skills

• Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
• Network and system administration experience in large or complex enterprise or service‑provider environments.
• Strong understanding of adversarial TTPs (including MITRE ATT&CK) and different operational threat environments (e.g., script kiddies, non nation state adversaries, nation state actors).
• Knowledge of defense‑in‑depth and zero trust principles and their application to network and edge‑device architectures.
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross‑site scripting, injections, race conditions, covert channels, replay, ROP, malicious code).
• Knowledge of network device integrity verification and monitoring approaches.
• Hands‑on skill in host/network intrusion detection and event correlation across multiple telemetry sources (firewalls, IDS/IPS, endpoint, SIEM).
• Experience with malicious activity analysis, including network beaconing, C2, and data exfiltration detection.
• Experience with Identity and Access Management (IAM) tools and their integration into network/edge security architectures.
• Ability to review and analyze Enterprise Architecture (EA) from a security perspective and recommend architecture‑level improvements.
• Ability to collaborate with stakeholders at multiple levels within an organization (technical staff, management, senior leadership).
• Field Diagnostics & Cyber Forensics: Skills in running preloaded analysis stacks, protocol parsers (e.g., Modbus, DNP3, OPC UA), vulnerability scanning, and local packet capture at line rate.
• Compact Pack & Weight Management: Packing, securing, and transporting ruggedized cases (such as Pelican or Nanuk) that fit standard weight and carry‑on/air‑transport limits.

Desired Certifications

• IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder,CEH, SANS GIAC GCIA or GNFA (preferred for network forensics). SANS GRID, GICSP, or GCIP (plus).
• Vendor / network certifications (highly desired):
  • Cisco CCNA (or higher: CCNP Security, CCNP Enterprise).
  • Vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti (e.g., PCNSE, JNCIS/JNCIP, etc.).

Required Education

Bachelor’s degree in Computer Engineering, Computer Science, Cybersecurity, or related field; High School Diploma and 22+ years of technical experience in the area of expertise.