About the role
Title: Network Based Systems Analyst II
Description: Solutions³ LLC provides remote and onsite advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation and resolution using host-based, network-based and cloud-based cybersecurity analysis capabilities. Team personnel provide front line response for digital forensics/incident response (DFIR) and proactively hunting for malicious cyber activity. Solutions³ LLC is seeking Cyber Network Defense Analysts (CNDA) to support this critical mission.
Salary Range: $75,000 - $94,000 Location: Arlington, VA Job Type: Onsite
Eligibility: * Must be a US Citizen * Must have an active TS/SCI clearance * Must be able to obtain DHS Suitability prior to starting employment * 2+ years of directly relevant experience in cyber defense analysis using leading edge technologies and industry standard cyber defense tools
Responsibilities Include: * Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources * Coordinate with enterprise-wide cyber defense staff to validate network alerts * Document and escalate incidents (including event's history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment * Perform cyber defense trend analysis and reporting * Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack * Provide daily summary reports of network events and activity relevant to cyber defense practices * Receive and analyze network alerts from various sources within the enterprise and determine possible causes of alerts * Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities * Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity * Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information * Identify and analyze anomalies in network traffic using metadata * Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools * Identify applications and operating systems of a network device based on network traffic * Reconstruct a malicious attack or activity based off network traffic * Identify network mapping and operating system (OS) fingerprinting activities * Assist in the construction of signatures which can be implemented on cyber defense network tools in response to new or observed threats within the network environment or enclave
Required Skills: * Experience successfully developing and deploying signatures * Experience detecting host and network-based intrusions via intrusion detection technologies (e.g., Snort) * Experience implementing incident handling methodologies * Experience implementing protocol analyzers * Experience collecting data from a variety of cyber defense resources * Experience reading and interpreting signatures (e.g. snort) * Experience performing packet-level analysis * Experience conducting trend analysis
Desired Skills: * Python programming experience * Strong math and science background * Experience with Carnegie Mellon SiLK tool suite
Desired Certifications: * One or more of the following professional certifications: GNFA, GCIH, GCIA, GSEC, CASP+, CySA+, PaLMS, FedVTE * GSEC (SANS401), Arcsight (or other SEIM solution), Network+, Security+
Required Education: BS Computer Science, Cybersecurity, Computer Engineering, or related degree; or HS Diploma and 4+ years of network investigations experience