COMPUTER NETWORK DEFENSE & INCIDENT RESPONSE ANALYST WITH SECURITY CLEARANCE
TEKsystems c/o Allegis Group
Charleston SC 29401 US
Top Skills' Details
1) IAT II and CND Analyst or IR compliant
2) IDS/IPS experience - Splunk
3) PCAP analysis - Wireshark. Job Description
Computer Network Defense & Incident Response Analyst
Charleston, SC **Minimum of a Secret Clearance Required with ability to obtain TS/SCI** Position Description As a CND Incident Response Analyst you will identify, isolate, investigate, inform, and implement measures to detect and protect data across a wide spectrum of sources and locations. You will validate suspicious events or reports and determine if the event constitutes an incident. You will ensure incidents are properly entered into the appropriate reporting system and determine the severity of the incident. Position Requirements and Duties
• Maintains familiarity with CJCSM 6510.01B.
• Compiles and maintains internal standard operating procedure (SOP) documentation.
• Ensures associated documentation and capabilities remain compliant with CJCSM 6510.01B and other applicable policy directives.
• Provides network intrusion detection and monitoring, correlation analysis, incident response and support for the Cybersecurity Service Provider (CSSP) and its subscriber sites.
• Validates suspicious events or reports and determine if the event constitutes an incident and properly enter associated data into the appropriate reporting systems.
• Provides 24x7 support for the CSSP’s Incident Response capability during non-core business hours consistent with CSSP requirements as needed.
• Performs network and host-based digital forensics on Microsoft Windows based systems and other operating systems as necessary to enhance response to, support of, and investigation into significant network incidents.
• Possesses working knowledge of full packet capture PCAP analysis and accompanying tools (Wireshark, etc.).
• Explores patterns in network and system activity via log correlation using Splunk and supplemental tools
• Possesses understanding of IDS/IPS solutions to include signature development and implementation
• Participates in program reviews, product evaluations, and onsite certification evaluations. -Up to 15% Travel may be required
- Overtime may be required as needed to support incident response actions (Surge)
- Due to the nature of the work required, operations are conducted 24/7/365 with three primary shifts. Qualifications
4+ years experience in Cybersecurity Service Provider (CSSP) environment or similar
DoD or DoN Cybersecurity Workforce (CSWF) Certification or compliance (DoDD 8140 or SECNAV M-5239) Required Skills
Knowledge of Incident Response Procedures
Knowledge of Packet Analysis
Knowledge of IDS/IPS solutions
Familiarity with various Host-Based Tools
Experience with Log Aggregation Tools
Logical thinking and analytical ability
Verbal and written communication ability Highly Desired Skills
Knowledge of CJCSM 6510.01B
Experience with Digital Forensics
The ability to solve problems independently Additional Skills & Qualifications
Must be IAT II and CND IR compliant. 90 days to obtain cert. Candidates highly preferred to be compliant upon interview.
***Need to be flexible on shifts based on the nature of the work 24/365. There is a weekend rotation. IAT II Certs and Above: CCNA Security, CySA+ **, GICSP, GSEC, Security+ CE, CND, SSCP, CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP
CSSP Certs: CEH, CFR, CCNA Cyber Ops, CCNA-Security, CySA+ **, GCIA, GCIH, GICSP, Cloud+, SCYBER, PenTest+, SSCP, CHFI, CFR, CND, CCNA-Security, GCFA, CISA, GSNA,, CISM, CISSP, CCISO
1) IAT II and CND Analyst or IR compliant
2) IDS/IPS experience - Splunk
3) PCAP analysis - Wireshark. Job Description
Computer Network Defense & Incident Response Analyst
Charleston, SC **Minimum of a Secret Clearance Required with ability to obtain TS/SCI** Position Description As a CND Incident Response Analyst you will identify, isolate, investigate, inform, and implement measures to detect and protect data across a wide spectrum of sources and locations. You will validate suspicious events or reports and determine if the event constitutes an incident. You will ensure incidents are properly entered into the appropriate reporting system and determine the severity of the incident. Position Requirements and Duties
• Maintains familiarity with CJCSM 6510.01B.
• Compiles and maintains internal standard operating procedure (SOP) documentation.
• Ensures associated documentation and capabilities remain compliant with CJCSM 6510.01B and other applicable policy directives.
• Provides network intrusion detection and monitoring, correlation analysis, incident response and support for the Cybersecurity Service Provider (CSSP) and its subscriber sites.
• Validates suspicious events or reports and determine if the event constitutes an incident and properly enter associated data into the appropriate reporting systems.
• Provides 24x7 support for the CSSP’s Incident Response capability during non-core business hours consistent with CSSP requirements as needed.
• Performs network and host-based digital forensics on Microsoft Windows based systems and other operating systems as necessary to enhance response to, support of, and investigation into significant network incidents.
• Possesses working knowledge of full packet capture PCAP analysis and accompanying tools (Wireshark, etc.).
• Explores patterns in network and system activity via log correlation using Splunk and supplemental tools
• Possesses understanding of IDS/IPS solutions to include signature development and implementation
• Participates in program reviews, product evaluations, and onsite certification evaluations. -Up to 15% Travel may be required
- Overtime may be required as needed to support incident response actions (Surge)
- Due to the nature of the work required, operations are conducted 24/7/365 with three primary shifts. Qualifications
4+ years experience in Cybersecurity Service Provider (CSSP) environment or similar
DoD or DoN Cybersecurity Workforce (CSWF) Certification or compliance (DoDD 8140 or SECNAV M-5239) Required Skills
Knowledge of Incident Response Procedures
Knowledge of Packet Analysis
Knowledge of IDS/IPS solutions
Familiarity with various Host-Based Tools
Experience with Log Aggregation Tools
Logical thinking and analytical ability
Verbal and written communication ability Highly Desired Skills
Knowledge of CJCSM 6510.01B
Experience with Digital Forensics
The ability to solve problems independently Additional Skills & Qualifications
Must be IAT II and CND IR compliant. 90 days to obtain cert. Candidates highly preferred to be compliant upon interview.
***Need to be flexible on shifts based on the nature of the work 24/365. There is a weekend rotation. IAT II Certs and Above: CCNA Security, CySA+ **, GICSP, GSEC, Security+ CE, CND, SSCP, CASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP
CSSP Certs: CEH, CFR, CCNA Cyber Ops, CCNA-Security, CySA+ **, GCIA, GCIH, GICSP, Cloud+, SCYBER, PenTest+, SSCP, CHFI, CFR, CND, CCNA-Security, GCFA, CISA, GSNA,, CISM, CISSP, CCISO