S

Solutions³

Cybersecurity, ITOM, ITSM consulting and training

Network Based Systems Analyst 4

Security Operations & Incident ResponsePosted on Nov 13
Full-timeArlington County, Arlington, VA, USA$112k - $131k /yr

About the Job

Requirements

  • At least 8 years of directly relevant experience.
  • At least 3 years of experience evaluating and implementing new cyber response or network forensic capabilities.
  • Hands-on incident response or network operations experience involving enterprise edge devices from at least two of Cisco, Ivanti, Palo Alto, Ciena, and Juniper.
  • Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
  • Knowledge of Computer Network Defense policies, procedures, and regulations relevant to U.S. government or similar environments.
  • Ability to characterize and analyze network traffic to identify anomalous activity and potential threats.
  • Ability to identify and analyze network traffic anomalies using metadata such as flow, DNS, and proxy data.
  • Ability to reconstruct malicious activity based on network traffic and device logs.
  • Understanding of general attack stages, including reconnaissance, initial access, lateral movement, and exfiltration, and how they appear across a network.
  • Understanding of system and application security threats and vulnerabilities and how they appear in network traffic.
  • Understanding of proactive systems and network analysis, including establishing trust levels for critical resources and detecting anomalous behavior.
  • Proficiency with common operating systems, including Linux/Unix and Windows.
  • Experience performing cyber incident response, including scoping, containment, eradication, and recovery, in operational environments.
  • Ability to make independent decisions under pressure and work with limited guidance.
  • Strong written and oral communication skills, including explaining technical issues to technical and non-technical stakeholders.
  • Ability to collaborate across physical locations and within distributed teams.
  • Skill in identifying attack classes and stages and translating findings into actionable recommendations.
  • Ability to rapidly configure network TAPs, packet brokers, SPAN ports, and unmanaged or managed switches without disrupting live production or air-gapped traffic.
  • Bachelor’s degree in Computer Science, Cyber Security, Computer Engineering, or a related degree; alternatively, a high school diploma and at least 10 years of technical experience in the area of expertise.

Responsibilities

  • Serve as a hunt and incident response subject matter expert, applying knowledge of threat actor tools, techniques, and procedures with a focus on network-centric and edge-device compromises.
  • Evaluate and integrate new network forensic and monitoring capabilities as part of a technology insertion team.
  • Assist the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.
  • Interface with the customer onsite and communicate status, findings, and recommendations.
  • Characterize and analyze network traffic, including packet captures, flow data, and device logs, to identify anomalous activity and potential network threats.
  • Analyze network traffic metadata, including flow records, DNS logs, and proxy logs, to detect and scope malicious activity.
  • Reconstruct attacks or malicious activities from network traffic, including timelines, attacker paths, and data-exfiltration patterns.
  • Examine network topologies to understand data flows, trust boundaries, and potential choke points and apply that knowledge to hunt and response activities.
  • Assess network topology and device configurations, identify security concerns, and recommend security best practices for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
  • Determine responses to anomalous network activity, including containment, eradication, and hardening actions.
  • Apply defense-in-depth principles and knowledge of attack stages to evaluate and improve network security architecture and edge-device configurations.
  • Validate network-device state, detect unauthorized modifications, and recommend remediation using network-device integrity concepts and methods.
  • Lead analysis of logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote-access appliances to identify, scope, and reconstruct intrusions.
  • Provide expert analysis and research with broad direction on complex hunt and incident response problems and processes.
  • Provide technical direction, interpretation, and alternatives as a technical expert on high-level incident response teams handling network-centric incidents.
  • Determine technical objectives and independently develop creative technical solutions to complex problems.
  • Analyze incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
  • Advise technical personnel on implementing and customizing countermeasures, such as firewall rules, intrusion prevention system signatures, and access control lists.
  • Support internal stakeholders on containment and eradication missions onsite and remotely.
  • Preserve evidence integrity according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
  • Assist in writing and publishing Computer Network Defense guidance and detailed incident-finding reports.
  • Prepare executive summaries and in-depth technical reports for leadership and technical audiences.
  • Document analysis, threat actor tools, techniques, and procedures, and device-specific incident-handling procedures in a standardized knowledge base for sharing and publication.
  • Assist in maintaining branch process and procedure documentation and guide completion of hunt and incident response activities.

Desired Qualifications

  • Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
  • Network and system administration experience in large or complex enterprise or service-provider environments.
  • Strong understanding of adversarial tools, techniques, and procedures, including MITRE ATT&CK, and operational threat environments involving script kiddies, non-state actors, and nation-state actors.
  • Knowledge of defense-in-depth and zero-trust principles and their application to network and edge-device architectures.
  • Knowledge of system and application security threats and vulnerabilities, including buffer overflows, mobile code, cross-site scripting, injection attacks, race conditions, covert channels, replay attacks, return-oriented programming, and malicious code.
  • Knowledge of network-device integrity verification and monitoring approaches.
  • Hands-on host and network intrusion detection and event correlation across firewalls, intrusion detection and prevention systems, endpoint telemetry, and security information and event management systems.
  • Experience analyzing malicious activity, including network beaconing, command-and-control activity, and data-exfiltration detection.
  • Experience with Identity and Access Management tools and their integration into network and edge-security architectures.
  • Ability to review Enterprise Architecture from a security perspective and recommend architecture-level improvements.
  • Ability to collaborate with stakeholders at technical, management, and senior leadership levels.
  • Field diagnostics and cyber forensics skills, including running preloaded analysis stacks, using protocol parsers such as Modbus, DNP3, and OPC UA, performing vulnerability scanning, and conducting local packet capture at line rate.
  • Ability to pack, secure, and transport ruggedized cases such as Pelican or Nanuk cases within standard weight and carry-on or air-transport limits.
  • Preferred certifications include IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder, CEH, SANS GIAC GCIA or GNFA, SANS GRID, GICSP, or GCIP.
  • Highly desired Cisco CCNA or higher-level certifications, including CCNP Security or CCNP Enterprise.
  • Highly desired vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti, such as PCNSE and JNCIS/JNCIP.

About the Company

Solutions³

Cybersecurity, ITOM, ITSM consulting and training

Solutions³ provides cybersecurity, IT operations management (ITOM), and IT service management (ITSM) consulting and training, with implementation supported by industry-standard practices. It works through a people–process–technology lifecycle that includes advisory services, training, and deployment of market-ready applications, in partnership with the DVMS Institute to Create, Protect, Deliver, and Verify Trusted Digital Business value. It stands apart by combining a formal, standards-driven end-to-end approach with recognized accreditations (APMG International, UK NCSC/GCHQ, DHS/CISA) and a collaborative methodology that yields clearly defined, executable projects aligned to client objectives. Its goal is to help organizations of any size manage digital risk, improve resiliency, and create value from digital services through governance, training, and proven implementation practices.

Company size
1-10
Company stage
Not listed
Total funding
Not listed
Headquarters
Wyckoff, NJ
Founded
2003

Recently Posted Jobs

Explore more opportunities at Solutions³

See more jobs