Responsibilities

Network monitoring to provide complete visibility into digital activity and better detect anomalies
Prevention techniques to deter and deflect a range of known and unknown risks
Threat detection and intelligence capabilities that assess the origin, impact and severity of each cybersecurity incident
Decisive incident response and remediation using a blend of automated technologies and human intervention
Reporting to ensure all incidents and threats are fed into the data repository, making it more precise and responsive in the future
Risk and compliance capabilities to ensure industry and government regulations are followed
Determine security violations and inefficiencies by conducting periodic audits
Upgrade our network and infrastructure systems
Implement and maintain security controls
Identify and solve potential and actual security problems
Assess the current situation, evaluating trends and anticipating security requirements
Keep users informed by preparing performance reports; communicating system status
Maintain quality service by following organization standards
Maintain technical knowledge by attending educational workshops
Contribute to team effort by accomplishing related results as needed

Job Requirements:

Advanced certifications such as SANS GIAC/GCIA/GCIH, CISSP or CASP and/or SIEM-specific training and certification
Advanced understanding of TCP/IP, common networking ports and protocols, traffic flow, system administration, OSI model, defense-in-depth and common security elements.
Hands-on experience analyzing high volumes of logs, network data (e.g. Netflow, FPC), and other attack artifacts in support of incident investigations
Experience with vulnerability scanning solutions
Familiarity with the DOD Information Assurance Vulnerability Management program.
Proficiency with any of the following: Anti-Virus, HIPS, ID/PS, Full Packet Capture, Host-Based Forensics, Network Forensics, and RSA Security
In-depth knowledge of architecture, engineering, and operations of at least one enterprise SIEM platform (e.g. Nitro/McAfee Enterprise Security Manager, ArcSight, QRadar, LogLogic, Splunk)
Experience developing and deploying signatures (e.g. YARA, Snort, Suricata, HIPS)
Understanding of mobile technology and OS (i.e. Android, iOS, Windows), VMware technology, and Unix and basic Unix commands