Tier 2 Cyber Incident Response Team (CIRT) Analyst

In this role, you will need to:

• Detect, classify, process, track, and report on cyber security events and incidents.
• Perform advanced in-depth analysis of coordinated Tier 1 alert triage and requests in a 24x7x365 environment.
• Analyze logs from multiple sources (e.g., host logs, EDR, firewalls, intrusion detection systems, servers) to identify, contain, and remediate suspicious activity.
• Characterize and analyze network traffic to identify anomalous activity and potential threats.
• Protect against and prevent potential cyber security threats and vulnerabilities.
• Perform forensic analysis of hosts artifacts, network traffic, and email content.
• Analyze malicious scripts and code to mitigate potential threats.
• Conduct malware analysis to generate IOCs to identify and mitigate threats.
• Collaborate with Department of State teams to analyze and respond to events and incidents.
• Monitor and respond to the CIRT Security Orchestration and Automation Response (SOAR) platform, hotline, email inboxes.
• Create tickets and initiate workflows as instructed in technical SOPs.
• Coordinate and report incident information to the Cybersecurity and Infrastructure Security Agency (CISA).
• Collaborate with other local, national and international CIRTs as directed.
• Submit alert tuning requests.

To be considered for this position, you must minimally meet the knowledge, skills, and abilities listed below:

• Bachelor's degree and at least 2 years of experience or a High School diploma and 6 years of experience.
• Must possess one of the following certifications prior to start date:
• A+ CE, CCNA-Security, CND, Network+ CE, SSCP, Security+.
• Demonstrated experience in the Incident Response lifecycle.
• Knowledge of SOAR ticketing and automated response systems (e.g. ServiceNow, Splunk SOAR, Microsoft Sentinel).
• Demonstrated experience with using Security Information and Event Management (SIEM) platforms (e.g. Splunk, Microsoft Sentinel, Elastic, Q-Radar).
• Demonstrated experience in using Endpoint Detection and Response systems (e.g. MDE, ElasticXDR, CarbonBlack, Crowdstrike).
• Knowledge of cloud security monitoring and incident response.
• Knowledge of integrating IOCs and Advanced Persistent Threat actors.
• Ability to analyze cyber threat intelligence reporting and understanding adversary methodologies and techniques.
• Knowledge of malware analysis techniques.
• Knowledge of the MITRE ATT&CK and D3FEND frameworks.

Preferred Qualifications:

• Proficiency with Splunk for security monitoring, alert creation, and threat hunting.
• Knowledge of Microsoft Azure access and identity management.
• Proficiency with Microsoft Defender for Endpoint and Identity for security monitoring, response, and alert generations.
• Experience in using digital forensics collection and analysis tools (e.g. Autopsy, MagnetForensics, Zimmerman-Tools, KAPE, CyLR, Volatility).
• Experience with using ServiceNow SOAR for ticketing and automated response.
• Knowledge of Python, PowerShell and BASH scripting languages.
• Experience with cloud security monitoring and incident response.
• Demonstrated ability to perform static/dynamic malware analysis and reverse engineering.
• Experience with integrating cyber threat intelligence and IOC-based hunting.
• Technical certifications such as: Security+, CySA+, Cloud+, Try Hack Me SAL1, Hack the Box CDSA, CyberDefenders, CCD, Azure SC-900, CCSP, GCIH, CCSK, GSEC, CHFI, GCLD, GCIA.
• Advanced technical certifications such as: SecurityX/CASP+, PRMP, GREM, GEIR, GNFA, or GCFA.