Security Analyst - Tier 1

• Perform cybersecurity activities as part of a team in an organization’s 24x7 Security Operations Center (SOC).
• Use data collected from a variety of cyber defense tools (e.g., intrusion detection system (IDS) alerts, firewalls, network traffic logs, Security Incident and Event Management (SIEM) to analyze events that occur within the environment for the purposes of mitigating threats in support of an organization’s security program.
• Work with stakeholders to resolve computer security incidents and vulnerability compliance.
• Conduct vulnerability scans and recognize vulnerabilities in security systems.
• Apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
• Apply techniques for detecting host and network-based intrusions using intrusion detection technologies.
• Interpret the information collected by network tools (e.g. Nslookup, Ping, and Traceroute).
• Characterize and analyze network traffic to identify anomalous activity and potential threats to network resources.
• Coordinate with SOC team and cyber defense staff to validate network alerts.
• Document and escalate incidents (including event's history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.
• Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack.
• Provide daily summary reports of network events and activity relevant to cyber defense practices.
• Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts.
• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.
• Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity.
• Examine network topologies to understand data flows through the network.
• Identify and analyze anomalies in network traffic using metadata (e.g., CENTAUR).
• Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.
• Isolate and remove malware.
• Identify applications and operating systems of a network device based on network traffic.
• Notify designated managers, cyber incident responders, stakeholders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event's history, status, and potential impact for further action in accordance with the organization's cyber incident response plan.
• Detect host and network based intrusions via intrusion detection technologies (e.g., Snort).
• Recognize and categorize types of vulnerabilities and associated attacks.
• Recognize vulnerabilities in security systems. (e.g., vulnerability and compliance scanning).
• Apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
• Identify cyber threats which may jeopardize organization and/or partner interests.
• Monitor security events involving high value assets.
• Conduct computer network defense (CND) triage to include:
• • Determine scope, urgency, and potential impact.
  • Identify specific vulnerability(s).
  • Recommend remediation actions.
  • Prepare reports on incident findings to appropriate agencies.
• Maintain appropriate technical and procedural documentation.
• Properly document all investigative activity is in the tracking/ticketing systems.
• Follow-up with relevant support teams on actions being taken until completion.
• Build and maintain client and stakeholder relationships.
• Complete projects, tasks, and associated deliverables on time and with quality.

• Must be eligible to obtain a Public Trust government security clearance.
• 4-year college degree in Computer Science or related field.
• Experience demonstrating strong analytical, troubleshooting and problem-solving skills for cybersecurity.
• Excellent communication skills, both written and oral.
• Knowledge of NIST and FISMA guidelines.
• Security certification.
• Preferred one (1) year of related technical, professional experience.

Desired Skills:

• Previous experience with Microsoft Defender for Endpoint (ATP), Tanium, and Splunk.