Threat analyst jobs in Alexandria, Virginia - Page 3Create job alerts

Job Description ZERO TRUST APPLICATIONS AND WORKLOADS SME MILITARY FRIENDLY & PREFERRED - HOH SPONSOR Zermount Inc. is seeking a Zero Trust (ZT) Applications and Workloads SME to assist in providing security to one of our federal clients. The ZT Applications and Workloads SME will be part of the implementation of ZT principles across the pillars of ZT (identity, device, network, application and workload, and data) to assist the client in meeting the requirements set forth by EO 14028 and OMB M 22-09. The ZT Applications and Workloads SME will be responsible for leading the design, development, and assessment of virtualization and application security solutions in alignment with Zero Trust principles. You will collaborate with cross-functional teams to understand business requirements and translate them into secure and scalable technical solutions. Your expertise in virtualization technologies, application development, cloud security, and Zero Trust principles will be crucial in ensuring the organization's systems and applications are resilient, secure, and compliant. Duties & Responsibilities: The ZT Applications and Workloads SME will ensure the Zermount ZT solutions and services secure federal networks and meet the objectives of EO 14028 and other Federal requirements. Additionally, the ZT Applications and Workloads SME will provide support and services to include: • Lead the design, development, and implementation of applications and workloads solutions aligned with Zero Trust principles., • Support the architecture and design of innovative solutions and services to secure client networks, and provide leadership with recommendations on the right technologies, solutions, and processes required to meet the objectives of EO 14028 and other Federal requirements., • Map ZT capabilities, requirements, and existing client capabilities, and new or approved capabilities required for the applications and workloads pillar as outlined by CISA, M-21-31, M-22-01, M-22-09, EO 14028, NIST 800-207, and any future memoranda, EO's, and standards., • Collaborate with cross-functional teams to understand business requirements and translate them into technical solutions., • Provide expertise for the secure development of applications, ensuring that security is integrated into the Software Development Lifecycle (SDLC) from the beginning and driving DevSecOps practices., • Provide expertise for segmenting workloads to isolate them from each other, reducing the attack surface and minimizing the impact of potential breaches., • Provides expertise for establishing continuous monitoring solutions and capabilities to detect and respond to anomalies and potential security threats within applications and workloads., • Provides expertise to ensure the secure integration of applications and workloads across various environments (e.g., cloud, on premises, and hybrid)., • Provide expertise in the review, assessment, and solution recommendation for Zero Trust maturity evaluations., • Stay up to date with emerging technologies and industry trends related to application security, application access controls, application threat protections, and secure application development., • A minimum of 10 years of IT cybersecurity experience including direct support for the US Government and 7 years acting as an ISSO, assessor, or compliance analyst for enterprise IT systems OR a relevant Bachelor's degree in IT, computer science, or engineering and 7 years of IT cybersecurity experience including direct support for the US Government and 5 years acting as an ISSO, assessor, or compliance analyst., • Solid experience in virtualization technologies, such as VMware, Hyper-V, or KVM., • Strong understanding of Zero Trust principles and their application in virtualization and application development., • Knowledge of containerization technologies like Docker and orchestration tools like Kubernetes., • Familiarity with cloud platforms and services, such as AWS, Azure, or Google Cloud., • Experience implementing security controls and best practices in virtualized environments and application development., • Ability to troubleshoot and resolve issues in virtualization, cloud, and application deployment., • Strong communication and collaboration abilities., • Experience communicating effectively, both oral and written, with technical, non-technical, and executive-level customers., • Knowledge of EO 14028, OMB M 22-09, Federal, DoD, and CISA Zero Trust Architecture, Maturity Model, and Technical Reference Architectures., • Excellent communication, collaboration, and problem-solving skills., • Knowledge of NIST Guidelines and FISMA Cybersecurity compliance requirements., • Technical knowledge of complex enterprise IT systems., • Knowledge and experience using relevant cybersecurity and analysis tools such as Archer, Nessus Security Center, Splunk, etc., • Ability to work independently and as part of a team., • Ability to navigate complex and politically sensitive client environments with professionalism, patience, and tact., • Application Access, • Demonstrated experience in automating application access decisions with enhanced contextual information and enforced expiration conditions to ensure adherence to the principle of least privilege., • Proven track record in automating application access decisions with expanded contextual information and enforced expiration conditions to adhere to the principle of least privilege., • Strong background in establishing an environment that continuously authorizes application access, incorporating real-time risk analytics and considering factors such as behavior or usage patterns., • Application Threat Protections:, • Extensive experience in implementing advanced threat protections into all application workflows, providing real-time visibility and monitoring., • Accessible Applications:, • Successful track record in delivering all relevant applications over open public networks to authorized users and devices, ensuring accessibility as needed., • Secure Application Development and Deployment Workflow:, • Proficient in utilizing immutable workloads wherever feasible, allowing changes to be effective only through redeployment, and eliminating administrator access to deployment environments by leveraging automated processes for code deployment., • Application Security Testing:, • Minimum of a Bachelor's Degree in one of the following: Information Technology (IT), computer science, management, business administration, or a related field., • At least one of the following security certifications:, • Certified Authorization Professional (CAP);, • Certified Information Systems Security Officer (CISSO);, • Certified Information Security Manager (CISM); or, • Certified Information Systems Security Professional (CISSP)., • Remote.

All-Source Critical Infrastructure Analyst The Opportunity: Do you find yourself constantly looking for more and better information? Do you want a job where you can use your knowledge and research skills to improve national security? Never has the role of an all-source analyst been so meaningful. More connected devices, larger storage capacity, and faster connections have resulted in an explosion of available information. The problem facing the intelligence community is no longer how to get more data, it's understanding how to turn the data they have into answers. That's where you come in. With critical thinking and flexibility, you quickly seek out the accurate data sources, sift through the raw data, and turn it into valuable intelligence. If you have strong analytical skills and a problem-solving mindset, we have an opportunity to use those skills to protect our national security. As an all-source analyst on our team, you'll explore new data sources, create effective queries, and combine information from disparate sources to help your client understand their mission environment. You'll work with interagency teams to determine threats to DoD critical infrastructure, providing executive clients with threat briefings and mitigation opportunities. This is a chance to grow your expertise, develop new skills, and share your methodologies with other analysts. We focus on growing as a team to deliver the best support to our customers, so you'll have resources for mentoring and learning new skills and tools. Join us as we provide the right information at the right time to support the critical needs of our policy makers. Join us. The world can't wait. You Have: \n • Experience with strategic all-source intelligence analysis, including using analytic tools to research data from multiple intelligence sources and analyzing findings\n, • Ability to develop high-quality deliverables tailored to senior policy makers or defense stakeholders, including complex written products and formal or informal briefings\n, • Active TS/SCI clearance; willingness to take a polygraph exam \n, • Experience authoring DoD or DIA product lines and utilizing ICD 203 tradecraft standards\n, • Experience identifying threats to U.S. interests and executing directed tasks supporting the Defense Critical Infrastructure Program, Defense Foreign Material Program, DoD Analytic Agenda, Defense Acquisition System, and Technology Security Program\n, • Experience with data analytics, analysis, and visualization\n Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information ; TS/SCI clearance is required. Compensation At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen's benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page. Salary at Booz Allen is determined by various factors, including but not limited to location, the individual's particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $77,600.00 to $176,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen's total compensation package for employees. This posting will close within 90 days from the Posting Date. Identity Statement As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud. Work Model Our people-first culture prioritizes the benefits of flexibility and collaboration, whether that happens in person or remotely. \n • If this position is listed as remote or hybrid, you'll periodically work from a Booz Allen or client site facility.\n All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.

Leidos has a current job opportunity for an Insider Threat/UAM (User Activity Monitoring) Analyst at the Mark Center in Alexandria, VA. At least 6 months of UAM or insider threat detection experience. Demonstrated experience with UAM capabilities and common insider threat TTPs.

Job Description H4 Enterprises is currently seeking the following: POSITION SUMMARY The Insider Threat Program Risk Administrator reviews, advises, and communicates risk policies and processes for the program. This position employs quantitative and analytical skills across a variety of business processes to ensure controls are operating effectively and provide research and analytical support. RELATIONSHIPS The Risk Administrator will receive direct government oversight, assignments, and directions from the Office Director, Insider Threat Program, through an assigned team leader. DUTIES & RESPONSIBILITIES • Serves as liaison between ITP and other Bureaus and Department offices to collect, review, and coordinate on key components and information to support program initiatives., • Coordinates with the Program Director, Senior Officials, Intelligence Community (IC), and other security agencies on the office insider threat program as required., • Prepares detailed memorandum containing sensitive information for Department Senior Managers, • Provides a managed structure of data for decision‐making and recommends courses of action., • Reviews information including but not limited to employee related data, counterintelligence, security, law enforcement, and workplace violence as it relates to insider threat and network., • Utilizes a variety of classified and unclassified databases, software applications, and other tools to review information related to the nature, function, relationships, capabilities, and intent of possible insider threats., • Follows computer generated leads to identify anomalies and/or support the insider threat processes., • Provides supporting documentation to formal investigations and/or informal inquiries to resolve insider threat related matters, employee misconduct, and/or violations of the law., • Conducts various background checks to facilitate analysis with the intake process periodically and when needed., • Reviews and prepares weekly, biweekly, and/or monthly status reports in a prescribed format for management review in coordination with the lead contractor manager., • Provides recommendations regarding case management and participates in the development of case management practices, procedures, and processes., • Manages projects in accordance with the statement of work, budget, and scheduled deliverables., • Develops and coordinates projects, including creation of special presentation charts, development of models and forms, and instruction of project management training., • Prepares and presents input for program briefings to the Program Director and senior officials., • Citizenship, • US. Citizenship required., • Education, • Preferred: Undergraduate in a related technical, security, or management discipline, • Seven (7) to ten (10) years of specialized experience accepted in lieu of degree., • Policy and security standards development, risk analysis and scheduling, logistics, budget analysis, and project management responsibilities, • Three (3) to five (5) years of direct government contracting experience at task/project management level., • Experience with applicable security requirements and practices in the civilian sector of the federal government., • Demonstration of experience consistent with security principles and best practices with applicable Federal regulations and guidelines, • Certified Counter‐Insider Threat Professional ‐ Fundamentals, • Preferred: Department of State experience, • Experienced in IC policies and procedures., • Proficient in IC database of individuals eligible for access to Sensitive Compartmented Information (SCI)Proficient in personnel security, counterintelligence, human resources, and government travel regulations, • Excellent oral and written communication skills and an ability to interface with program personnel at all levels., • Works independently, with minimal oversight, to advise and assist office personnel on matters of insider threat program policy, procedures, and regulations. Position will be subject to a U.S. Government Security Investigation. Incumbent must possess or obtain/maintain minimum a TOP SECRET clearance with ability to obtain special access requirements (SCI). PLACE OF PERFORMACE Primarily, the work will take place at a designated Department of State Location in the National Capital Region. EEO Statement H4 Enterprises, LLC does not discriminate in employment on the basis of race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, military service, or other non-merit factor. Company DescriptionH4 Enterprises, LLC (H4) is headquartered in Fayetteville NC. H4 is a DSS, cleared Small Business Administration 8(A) (Until March 2025) and Certified Service-Disabled Veteran-Owned Small Business (CVE)providing systems integration services to the federal government. H4 support Government Organization (GO), Non-Governmental Organization. H4 Professional Personnel Services / Training • H4 currently has SME’s whose experiences range from former country security analyst to former directors within various U.S. governmental agencies. Our SMEs average over 20 years within their respective fields and continue to have significant contact within their specific disciplines.H4 Enterprises, LLC (H4) is headquartered in Fayetteville NC. H4 is a DSS, cleared Small Business Administration 8(A) (Until March 2025) and Certified Service-Disabled Veteran-Owned Small Business (CVE)providing systems integration services to the federal government. H4 support Government Organization (GO), Non-Governmental Organization. H4 Professional Personnel Services / Training • H4 currently has SME’s whose experiences range from former country security analyst to former directors within various U.S. governmental agencies. Our SMEs average over 20 years within their respective fields and continue to have significant contact within their specific disciplines.

Job DescriptionCome make your mark with Watermark!🎖️ FOUNDED BY USAF VETERANS in 2007, we are proud to be a Service-Disabled Veteran Owned Small Business. 🌎 SUBJECT MATTER EXPERTS specializing in security and risk management. We’re intimately familiar with DOD security programs and mission requirements. ⭐ OUR CORE VALUES drive every action we take as a company. We strive to exhibit PERSPECTIVE, PASSION, COMMUNICATION, INTEGRITY AND ETHICS, and BALANCE in all we do. 💲 COMPETITIVE BENEFITS PACKAGE to address our employees’ physical, mental, emotional, and financial well-being. This includes 100% employer- paid medical insurance, ample paid leave, a free employee assistance program, and a competitive 401k savings plan. At Watermark, our people come first! Education and Training Analyst In this role you will…. • Mission Assurance Team Lead shall operate as the personnel responsible for the pre-assessment coordination requirements with AF/A3OB Mission Analyst and providing installation support for the development and publication of the All Hazards and Threat Assessment (AHTA) product in Enterprise Protection Risk Management (EPRM) and coordinating analysis of information gathered from applicable systems, orders, and plans as it relates to the mission focus of the assessment., • Works collaboratively with Support Staff who are responsible for reporting to AF/A3OB on a regular basis.Experience Requirements:, • Understanding of pre-assessment phase activities (e.g. Mission Analysis and Pre-Site Survey), • Assessment phase activities to include onsite vulnerability and risk assessments, • Post assessment phase activities (e.g., Post Analysis, Report Writing, and Major Command follow-up), • Experience in conducting All – Hazards Assessments using a risk-based approach is highly desired, but not required, • Bachelor’s degree or equivalent experience, • A minimum of 3-5 years leading an antiterrorism or mission assurance assessment team.Security Clearance Requirements:, • TS/SCIOther Requirements:, • May be required to move equipment/files weighing up to 50 pounds, • Requires ability to consistently perform repetitive tasks including filing and scanning, • May require sedentary work at least 50% of the time, • Reports to a physical location which occasionally requires the ability to traverse between buildings, • Ability to manage stress with a high degree of maturity/professionalism, • Demonstrated critical thinking and leadership skills and the ability to work well with others, • Effective verbal and written communication skills, • Other duties as assignedThis position is contingent on funding.*** Watermark provides salary ranges with job postings in states where it is legally required; any other salary ranges associated with our postings are third party estimates and may not be an accurate reflection of Watermark’s total compensation package. Multiple considerations are taken into account when determining the final salary/hourly rate, including but not limited to, Contract Wage Determination, education and certifications, relevant work experience, related skills and competencies, as well as Federal Government Contract Labor Categories. Central to Watermark’s employment philosophy is the wellbeing of our employees which is why we offer a robust benefits package and wellness program alongside of annual base compensation. Watermark is an equal opportunity employer. All terms and conditions of employment are established without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, veteran status, or any other protected category under applicable federal, state, and local laws. Powered by JazzHR kunFruMTtA

Job Description Network-Based System Analyst Location: Arlington, VA Must have an active Top Secret Security Clearance Node provides remote and onsite advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation and resolution using host-based, network-based and cloud-based cybersecurity analysis capabilities. Team personnel provide front line response for digital forensics/incident response (DFIR) and proactively hunting for malicious cyber activity. We are seeking Cyber Network Defense Analysts (CNDA) to support this critical customer mission. The CDNA uses information collected from a variety of sources to monitor network activity and analyze it for evidence of suspicious behavior. Monitoring and analysis are performed to identify and report events that occur, or might occur, within the network, in order to protect information, information systems, and networks from threats. Responsibilities: • Assists the Government lead in coordinating teams in preliminary incident response investigations, • Assists the Government lead with interfacing with the customer while on site, • Determines appropriate courses of actions in response to identified and analyses anomalous network activity, • Assesses network topology and device configurations identifying critical security concerns and providing security best practice recommendations, • Collects network intrusion artifacts (e.g., PCAP, domains, URI’s, certificates, etc.) and uses discovered data to enable mitigation of potential Computer Network Defense incidents, • Analyzes identified malicious network activity to determine weaknesses exploited, exploitation methods, effects on system and information, • Collects network device integrity data and analyze for signs of tampering or compromise, • Assists with real-time CND incident handling (i.e., forensic collections, intrusion correlation and tracking, threat analysis, and advising on system remediation) tasks to support onsite engagements Requirements Required Skills: • U.S. Citizenship, • Must have an active TS/SCI clearance, • Must be able to obtain DHS Suitability, • 5+ years of directly relevant experience in network investigations, • In depth knowledge of CND policies, procedures and regulations, • In depth knowledge of TCP/IP protocols, • In depth knowledge of standard protocols – ICMP, HTTP/S, DNS, SSH, SMTP, SMB, NFS, etc., • In depth knowledge and experience of Wifi networking, • In depth knowledge and experience of network topologies - DMZ’s, WAN’s, etc., • Substantial knowledge of Splunk (or other SIEM’s), • Understanding of MITRE Adversary Tactics, Techniques and Common Knowledge (ATT&CK), • Knowledge of Computer Network Defense policies, procedures, and regulations, • Knowledge of defense-in-depth principles and general attack stages with respect to network security architecture, • Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources, • Ability to identify and analyze anomalies in network traffic using metadata, • Experience with reconstructing a malicious attack or activity based on network traffic, • Experience examining network topologies to understand data flows through the network, • Must be able to work collaboratively across physical locations Desired Skills: • Substantial knowledge of network device integrity concepts and methodologies, • Proficiency with network analysis software (e.g. Wireshark), • Proficiency with carving and extracting information from PCAP data, • Proficiency with non-traditional network traffic (e.g. Command and Control), • Proficiency with preserving evidence integrity according to standard operating procedures or national standards, • Proficiency with virtualized environments Required Education: BS Computer Science, Cyber Security, Computer Engineering, or related degree; or HS Diploma & 7-9 years of network investigations experience. Desired Certifications: • DoD 8140.01 IAT Level II, IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Analyst/CSSP Incident Responder, CEH, • SANS GIAC GNFA preferred Company Overview: Node.Digital is an independent Digital Automation & Cognitive Engineering company that integrates best-of-breed technologies to accelerate business impact. Our Core Values help us in our mission. They include: OUR CORE VALUES Identifying theand developing them to their full capabilities Our customer’s “Mission” is our “Mission”. Ourapproach is designed to keep our customers fully engaged while becoming their trusted partner We believe incomplex problems with a relentless focus on agile delivery excellence Our mantra is “” in the delivery of innovative services and solutions. Benefits We are proud to offer competitive compensation and benefits packages to include: • Medical, • Dental, • Vision, • Basic Life, • Long-Term Disability, • Health Savings Account, • 401K, • Three weeks of PTO, • 10 Paid Holidays, • Pre-Approved Online Training

Job DescriptionTitle: Network Based Systems Analyst III Description: Solutions³ LLC is supporting our prime contractor and their U.S. Government customer on a large mission critical development and sustainment program for on and offsite incident response to Government agencies and critical infrastructure owners who experience cyber-attacks. Solutions³ LLC provides advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation, using host and network-based cybersecurity analysis capabilities. Solutions³ LLC is seeking a Network Based Systems Analyst III to support this critical mission by providing front line response for digital forensics/incident response (DFIR) and proactively hunting for malicious cyber activity. Eligibility: • Must be a US Citizen, • Must have an active TS/SCI clearance, • Must be able to obtain DHS Suitability prior to starting employment, • 5+ years of directly relevant experience in network investigations Responsibilities Include:, • Assists the Government lead in coordinating teams in preliminary incident response investigations, • Assists the Government lead with interfacing with the customer while on site, • Determines appropriate courses of actions in response to identified and analyses anomalous network activity, • Assesses network topology and device configurations identifying critical security concerns and providing security best practice recommendations, • Collects network intrusion artifacts (e.g., PCAP, domains, URI’s, certificates, etc.) and uses discovered data to enable mitigation of potential Computer Network Defense incidents, • Analyzes identified malicious network activity to determine weaknesses exploited, exploitation methods, effects on system and information, • Collects network device integrity data and analyze for signs of tampering or compromise, • Assists with real-time CND incident handling (i.e., forensic collections, intrusion correlation and tracking, threat analysis, and advising on system remediation) tasks to support onsite engagements Required Skills:, • In depth knowledge of CND policies, procedures and regulations, • In depth knowledge of TCP/IP protocols, • In depth knowledge of standard protocols – ICMP, HTTP/S, DNS, SSH, SMTP, SMB, NFS, etc., • In depth knowledge and experience of Wifi networking, • In depth knowledge and experience of network topologies - DMZ’s, WAN’s, etc., • Substantial knowledge of Splunk (or other SIEM’s), • Understanding of MITRE Adversary Tactics, Techniques and Common Knowledge (ATT&CK), • Knowledge of Computer Network Defense policies, procedures, and regulations, • Knowledge of defense-in-depth principles and general attack stages with respect to network security architecture, • Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources, • Ability to identify and analyze anomalies in network traffic using metadata, • Experience with reconstructing a malicious attack or activity based on network traffic, • Experience examining network topologies to understand data flows through the network, • Must be able to work collaboratively across physical locations Desired Skills:, • Substantial knowledge of network device integrity concepts and methodologies, • Proficiency with network analysis software (e.g. Wireshark), • Proficiency with carving and extracting information from PCAP data, • Proficiency with non-traditional network traffic (e.g. Command and Control), • Proficiency with preserving evidence integrity according to standard operating procedures or national standards, • Proficiency with virtualized environments Desired Certifications:, • DoD 8140.01 IAT Level II, IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Analyst/CSSP Incident Responder, CEH W1vm8TAoht

Job DescriptionAbout ARSIEM Corporation At ARSIEM Corporation we are committed to fostering a proven and trusted partnership with our government clients. We provide support to multiple agencies across the United States Government. ARSIEM has an experienced workforce of qualified professionals committed to providing the best possible support. As demand increases, ARSIEM continues to provide reliable and cutting-edge technical solutions at the best value to our clients. That means a career packed with opportunities to grow and the ability to have an impact on every client you work with. ARSIEM is looking for a Network Forensics Cybersecurity Analyst. This position will support one of our Government clients in Arlington, VA.Responsibilities • Assists the Government lead in coordinating teams in preliminary incident response investigations, • Assists the Government lead with interfacing with the customer while on site, • Determines appropriate courses of actions in response to identified and analyses anomalous network activity, • Assesses network topology and device configurations identifying critical security concerns and providing security best practice recommendations, • Assists with the writing and publishing of Computer Network Defense guidance and reports on incident findings to appropriate constituencies, • Collects network intrusion artifacts (e.g., PCAP, domains, URI’s, certificates, etc.) and uses discovered data to enable mitigation of potential Computer Network Defense incidents, • Analyzes identified malicious network activity to determine weaknesses exploited, exploitation methods, effects on system and information, • Assists with real-time CND incident handling (i.e., forensic collections, intrusion correlation and tracking, threat analysis, and advising on system remediation) tasks to support onsite engagements, • Provide technical briefings as requiredMinimum Qualifications, • BS Computer Science, Cyber Security, Computer Engineering, or related degree; or HS Diploma & 10+ years of network investigations experience., • 8+ years of directly relevant experience in network investigations, • In-depth knowledge of CND policies, procedures, and regulations, • In-depth knowledge of standard protocols – ICMP, HTTP/S, DNS, SSH, SMTP, SMB, NFS, TCP/IP, • In-depth knowledge and experience of Wifi networking, • In-depth knowledge and experience of network topologies, DMZs, WANs, etc., • Substantial knowledge of Splunk (or other SIEMs), • Understanding of MITRE Adversary Tactics, Techniques and Common Knowledge (ATT&CK), • Knowledge of Computer Network Defense policies, procedures, and regulations, • Knowledge of defense-in-depth principles and general attack stages with respect to network security architecture, • Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources, • Ability to identify and analyze anomalies in network traffic using metadata, • Experience with reconstructing a malicious attack or activity based on network traffic, • Experience examining network topologies to understand data flows through the network, • Must be able to work collaboratively across physical locationsPreferred Qualifications, • Substantial knowledge of network device integrity concepts and methodologies, • Proficiency with network analysis software (e.g. Wireshark), • Proficiency with carving and extracting information from PCAP data, • Proficiency with non-traditional network traffic (e.g. Command and Control), • Proficiency with preserving evidence integrity according to standard operating procedures or national standards, • Proficiency with virtualized environments

Job DescriptionAbout ARSIEM Corporation At ARSIEM Corporation we are committed to fostering a proven and trusted partnership with our government clients. We provide support to multiple agencies across the United States Government. ARSIEM has an experienced workforce of qualified professionals committed to providing the best possible support. As demand increases, ARSIEM continues to provide reliable and cutting-edge technical solutions at the best value to our clients. That means a career packed with opportunities to grow and the ability to have an impact on every client you work with. ARSIEM is looking for a Cyber Network Defense Analyst. This position is on-site to support one of our Government clients in Arlington, VA.Responsibilities • Assists the Government lead in coordinating teams in preliminary incident response investigations, • Assists the Government lead with interfacing with the customer while on-site, • Determines appropriate courses of action in response to identified and analyses anomalous network activity, • Assesses network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, • Collects network intrusion artifacts (e.g., PCAP, domains, URIs, certificates, etc.) and uses discovered data to enable mitigation of potential Computer Network Defense incidents, • Analyzes identified malicious network activity to determine weaknesses exploited, exploitation methods, effects on system and information, • Collects network device integrity data and analyzes for signs of tampering or compromise, • Assists with real-time CND incident handling (i.e., forensic collections, intrusion correlation and tracking, threat analysis, and advising on system remediation) tasks to support onsite engagementsMinimum Qualifications, • BS Computer Science, Cyber Security, Computer Engineering, or related degree; or HS Diploma & 7-9 years of network investigations experience., • 5+ years of directly relevant experience in network investigations, • In-depth knowledge of CND policies, procedures and regulations, • In-depth knowledge of TCP/IP protocols, • In-depth knowledge of standard protocols – ICMP, HTTP/S, DNS, SSH, SMTP, SMB, NFS, etc., • In-depth knowledge and experience of Wifi networking, • In-depth knowledge and experience of network topologies DMZ, WANs, etc., • Substantial knowledge of Splunk (or other SIEM’s), • Understanding of MITRE Adversary Tactics, Techniques and Common Knowledge (ATT&CK), • Knowledge of Computer Network Defense policies, procedures, and regulations, • Knowledge of defense-in-depth principles and general attack stages with respect to network security architecture, • Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources, • Ability to identify and analyze anomalies in network traffic using metadata, • Experience with reconstructing a malicious attack or activity based on network traffic, • Experience examining network topologies to understand data flows through the network, • Must be able to work collaboratively across physical locationsPreferred Qualifications, • Substantial knowledge of network device integrity concepts and methodologies, • Proficiency with network analysis software (e.g., Wireshark), • Proficiency with carving and extracting information from PCAP data, • Proficiency with non-traditional network traffic (e.g., Command and Control), • Proficiency in preserving evidence integrity according to standard operating procedures or national standards, • Proficiency with virtualized environments, • DoD 8140.01 IAT Level II, IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Analyst/CSSP Incident Responder, CEH

Job DescriptionTitle: Network Based Systems Analyst IV Description: Solutions³ LLC is supporting our prime contractor and their U.S. Government customer on a large mission critical development and sustainment program for on and offsite incident response to Government agencies and critical infrastructure owners who experience cyber-attacks. Solutions³ LLC provides advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation, using host and network-based cybersecurity analysis capabilities. Solutions³ LLC is seeking a Network Based Systems Analyst IV to support this critical mission by providing front line response for digital forensics/incident response (DFIR) and proactively hunting for malicious cyber activity. Eligibility: • Must be a US Citizen, • Must have an active TS/SCI clearance, • Must be able to obtain DHS Suitability prior to starting employment, • 8+ years of directly relevant experience in network investigations Responsibilities Include:, • Assists the Government lead in coordinating teams in preliminary incident response investigations, • Assists the Government lead with interfacing with the customer while on site, • Determines appropriate courses of actions in response to identified and analyses anomalous network activity, • Assesses network topology and device configurations identifying critical security concerns and providing security best practice recommendations, • Assists with the writing and publishing of Computer Network Defense guidance and reports on incident findings to appropriate constituencies, • Collects network intrusion artifacts (e.g., PCAP, domains, URI’s, certificates, etc.) and uses discovered data to enable mitigation of potential Computer Network Defense incidents, • Analyzes identified malicious network activity to determine weaknesses exploited, exploitation methods, effects on system and information, • Provide technical briefings as required, • Assists with real-time CND incident handling (i.e., forensic collections, intrusion correlation and tracking, threat analysis, and advising on system remediation) tasks to support onsite engagements Required Skills:, • In depth knowledge of CND policies, procedures and regulations, • In depth knowledge of standard protocols – ICMP, HTTP/S, DNS, SSH, SMTP, SMB, NFS, TCP/IP, • In depth knowledge and experience of Wifi networking, • In depth knowledge and experience of network topologies - DMZ’s, WAN’s, etc., • Substantial knowledge of Splunk (or other SIEM’s), • Understanding of MITRE Adversary Tactics, Techniques and Common Knowledge (ATT&CK), • Knowledge of Computer Network Defense policies, procedures, and regulations, • Knowledge of defense-in-depth principles and general attack stages with respect to network security architecture, • Ability to characterize and analyze network traffic to identify anomalous activity and potential threats to network resources, • Ability to identify and analyze anomalies in network traffic using metadata, • Experience with reconstructing a malicious attack or activity based on network traffic, • Experience examining network topologies to understand data flows through the network, • Must be able to work collaboratively across physical locations Desired Skills:, • Substantial knowledge of network device integrity concepts and methodologies, • Proficiency with network analysis software (e.g. Wireshark), • Proficiency with carving and extracting information from PCAP data, • Proficiency with non-traditional network traffic (e.g. Command and Control), • Proficiency with preserving evidence integrity according to standard operating procedures or national standards, • Proficiency with virtualized environments Desired Certifications:, • DoD 8140.01 IAT Level II, IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Analyst/CSSP Incident Responder, CEH KOMTecEJnE