Cyber Threat Analyst (Hybrid) at A.C. Coy

Falls Church, Virginia, United States -

Full Time

Start Date

Immediate

Expiry Date

28 Apr, 26

Salary

0.0

Posted On

28 Jan, 26

Experience

10 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Cyber Threat Analysis, Security Escalations Triage, Incident Detection, AI/ML Implementation, SOAR Platform Support, Risk-Based Alerting (RBA), IDS/IPS Monitoring, Splunk, Tanium, MS Defender, SentinelOne, Vulnerability Assessments, CVE Analysis, Network Traffic Analysis, Signature Construction, Technical Communication

Industry

Information Technology & Services

Description

Overview Tier One Technologies is looking for a Cyber Threat Analyst to work with our direct US Government client. This hybrid Contract-to-Hire position will be located in Falls Church, VA. SELECTED CANDIDATES WITHOUT REQUIRED CLEARANCE WILL BE SUBJECT TO A FEDERAL GOVERNMENT BACKGROUND INVESTIGATION TO RECEIVE IT. Responsibilities Responsible for performing triage on all security escalations and detections to determine scope, severity, and root cause. Monitor cyber security events, detecting incidents, and investigating incidents. Identify, recommend strategies, develop, and implement automation use cases leveraging AI/ML capabilities. Support deploying, configuring, testing, and maintaining Security Orchestration, Automation, and Response (SOAR) platform, and tools integrated with AI/ML capabilities to enhance threat detection, analysis and response. Develop, test and Implement dynamic Risk-Based Alerting (RBA). Identify and develop RBA and identifying use cases for SOAR and AI/ML. Monitor and analyze alerts from various sources such as IDS/IPS, Splunk, Tanium, MS Defender, SentinelOne and Cloud security tools leveraging SOAR and AI/ML capabilities, and provide recommendation for further tuning of these alerts when necessary. Analyze network traffic utilizing available tools and provide recommendations. Perform vulnerability assessments of recently discovered CVEs against internal systems and network. Assist in the process of configuring or re-configuring the security tools. Perform analysis on hosts running on a variety of platforms and operating systems, to include, but not limited to, Microsoft Windows, UNIX, Linux, as well as embedded systems and mainframes. Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the network environment or enclave. Test, evaluate, and verify hardware and/or software to determine compliance with defined specifications and requirementsProvide support to contract Program Manager, as necessary. Effectively communicates technical information to non-technical audiences. Influence others to comply with policies and conform to standards and best practices. Qualifications Bachelor's or Master's Degree in Computer Science, Information Systems, or other related fields. 8+ years of experience with security operations, threat hunting, and incident response Experience in analyzing alerts from Cloud, SIEM, EDR, and XDR tools, and alerts tuning process with preference on SentinelOne, Armis, and Splunk. Experience in configuring network devices and analyzing network traffic Experience with Artificial Intelligence and Machine Learning (AI/ML) based security tools. Experience in researching, developing, and implementing SOAR use cases. Familiarity with Security Orchestration, Automation, and Response (SOAR) platform. Familiarity with cybersecurity operation center functions. Experience configuring and re-configuring security tools, including SenintelOne and Splunk. Experience implementing Security frameworks, such as MITRE ATT&CK and NIST, and can interpret use cases into actionable monitoring solutions. CERTIFICATIONS (One or more required): CISSP or CISA or CISM or GIAC or RHCE. Excellent oral and written communication skills. Must be able to obtain a Position of Public Trust Clearance. All candidates must be a US Citizen or have permanent residence status (Green Card). Candidate must have lived in the United States for the past 5 years. Cannot have more than 6 months travel outside the United States within the last 5 years. Military Service excluded.

Responsibilities

The analyst will be responsible for triaging security escalations and detections to determine scope and severity, while monitoring cyber security events to detect and investigate incidents. Key duties include developing and implementing automation use cases leveraging AI/ML and supporting the deployment and maintenance of SOAR platforms.