Cyber Security Operations Specialist III - Tier 3

Description

This is a full-time, regular Information Technology role in the company's CSOC Tier 3 service, which runs around the clock, every day of the year.

The work centres on containing, removing and recovering from security events and incidents, along with malware and implant analysis and forensic artifact handling.

During an active incident, contractors work under the direction of the Government CIRT Commander. Between incidents, the team runs ongoing exercises and dry runs to sharpen response.

The role requires an active TS/SCI clearance to start. Travel is local and up to 10% of the time.

Responsibilities

• Carry out analysis, plan and execute containment steps, and record response work during incidents. This includes IP blocks, domain blocks and disabling user accounts, but only when the Government directs it.
• Work with the Security and Installations Directorate's Office of Counterintelligence and Insider Threat Office, plus other law enforcement and counterintelligence staff as needed, to investigate and triage incidents in depth.
• Help prepare security incident reports with the relevant authorities.
• Classify incidents and events.
• Work with other contracts, organisations, activities and services so incidents are reported, contained and eradicated correctly.
• Coordinate with the same groups to deconflict blue and red team activity against open incidents and events.
• Coordinate with other contracts, organisations, activities and services to help the agency recover from an incident or event.
• Build timelines, documents and briefings that keep stakeholders informed about response actions, analysis, and the effect of adversary activity and friendly response actions.
• Log actions and analysis in the approved ticketing system in enough detail that they can be rebuilt step by step.
• Build reports in JIMS, ICMS and other approved systems, and generate and update them once the Government approves and directs.
• Build, maintain and run custom scripts, tools and capabilities to collect data, analyse it and respond to incidents and events, once the Government authorises their use.
• Perform digital media analysis on host, server and network data, including volatile and non-volatile memory and system artifact collection and analysis.
• Identify indicators of compromise and send them to cybersecurity stakeholders and other contract services.
• Attribute adversary activity.
• Carry out malware analysis and write signatures.
• Work with CSOC Tier 1 and Tier 2 services to fix every discrepancy and recommend steps to stop it recurring.

Requirements

• Required:
• Bachelor's degree and/or 6 years of experience in cyber security (CSOS).
• Active TS/SCI clearance, and the ability to obtain a polygraph.
• DoDD 8140.01 and DoD 8570.01-M IAT Level II certification, plus CSSP Incident Responder.
• Contribute to and coordinate with all relevant stakeholders on the daily CSOC Significant Activity Report, the daily CSOC Operations Update and the weekly CSOC Status Report.
• Serve as a C-IRT member when required, under the direct control of and direction from the Government C-IRT Commander.
• Build and coordinate courses of action with Government and contract stakeholders. When the Government authorises it, carry out Defensive Cyberspace Operations-Internal Defensive Measures on NGA networks and systems for the NGA.
• Perform digital media analysis and malware reverse engineering on host, server and network data, including volatile and non-volatile memory and system artifact collection and analysis.
• Run custom scripts, tools and capabilities to collect and analyse data and respond to incidents and events, once the Government has authorised you.
• Write incident investigation reports for the Government covering the full incident lifecycle and response, including adversary and friendly force activity, host and network analysis, timelines, corrective action recommendations, and new Tactics, Techniques and Procedures (TTP) recommendations. Deliver them within 30 days of C-IRT stand-down.
• Each week, perform quality control reviews on a percentage of closed CSOC Tier 2 tickets to check analysis, categorisation, documentation and notification.
• Desired:
• Master's degree.
• IAT III certification.

Conditions

Salary depends on factors such as location, Federal Government labour categories and contract wage rates, relevant experience, specific skills, education and certifications.

The role can be based in more than one location, so the range shown is the national average for the position.

The proposed salary range is $75,200-$158,100.

Within six months of starting, all staff on this service must hold a certification compliant with DoDD 8140.01 and DoD 8570.01-M IAT Level III and CSSP Incident Responder.

Benefits

• Comprehensive benefits covering healthcare, wellness, finances, retirement, family support, continuing education and time off.
• Flexible time off that lets you take the time you need.
• Access to learning resources to support your career development.