Active Department of Defense Secret clearance or above is required.
A Department of Defense 8140 IAT Level II or higher certification, such as CompTIA Security+ CE, CySA+, ISC2 SSCP, or SANS GSEC, is required before starting.
A Department of Defense 8140 CSSP-A-level certification, such as CEH, CySA+, or GCIA, is required within 180 days of hire.
A strong foundation in networking is required, including packet analysis, common ports and protocols, and traffic flow.
Knowledge of the OSI model, defense-in-depth security principles, and common security elements for effective threat detection, analysis, and mitigation as a SOC Security Analyst is required.
For Level I, a bachelor's degree and at least 1 year of relevant experience are required; equivalent work experience and/or military service may be considered instead of a degree.
For Level II, a bachelor's degree and at least 3 years of relevant experience are required; equivalent work experience and/or military service may be considered instead of a degree.
The candidate must be able to work independently and collaboratively, and show initiative and a strong work ethic.
The candidate must be committed to continuous learning and self-improvement in cybersecurity, including pursuing certifications, participating in industry forums, and staying current with emerging threats and technologies.
The candidate must be able to solve complex security challenges with cross-functional teams, communicate technical information clearly and concisely, build consensus, and drive solutions to completion.
The candidate must be reliable and flexible, willing to work assigned shifts to support operational requirements and team objectives.
The candidate must live within commuting distance of Scott Air Force Base, Illinois.
Responsibilities
Investigate alerts generated from endpoints, IDS/IPS, NetFlow data, and custom sensors to detect compromises on customer networks.
Analyze extensive log files, pivot between diverse datasets, and correlate evidence to support incident investigations; create detailed technical reports outlining findings.
Monitor and analyze Department of Defense and open-source intelligence feeds to identify Indicators of Compromise and integrate them into security sensors and SIEMs.
Report security incidents to customers and USCYBERCOM, ensuring timely communication and coordinated response.
Support a 24/7 cyber network defense operation for Department of Defense networks at Scott Air Force Base by analyzing real-time threat intelligence, correlating security events, conducting raw-packet network traffic analysis, and collaborating with incident response teams to contain and eradicate threats.
Desired Qualifications
Hands-on experience analyzing large volumes of logs, network data such as NetFlow and full packet capture, and other attack artifacts during incident investigations.
In-depth experience using a SIEM/SOAR platform to analyze multiple log types and events across diverse data points, applying behavioral analysis, statistical analysis, and machine learning to detect and respond to advanced threats.
Comprehensive understanding of the network threat lifecycle, attack vectors, and exploitation methods, including intrusion-set tactics, techniques, and procedures.
Experience with antivirus, HIPS/HBSS, IDS/IPS, full packet capture, and network forensics tools.
Experience or knowledge in monitoring, defending, administering, or deploying cloud networks, including AWS, Azure, GCP, cloud-native security tools and strategies, and identification and mitigation of cloud-specific attacks.
Experience managing, defending, administering, or deploying enterprise mobile devices, including iOS, Android, mobile device management, mobile application management, and mobile threat defense, along with understanding mobile security best practices and the mobile threat landscape.
Scripting and programming skills.
Job Summary
Newberry Group's Public Sector Division is seeking Cybersecurity Analysts with the expertise to support a 24/7 Cyber Network Defense (CND) Operation for Department of Defense networks at Scott Air Force Base in Illinois. This includes analyzing real-time cyber threat intelligence to stay ahead of emerging threats, correlating security events to identify and prioritize potential incidents, conducting network traffic analysis using raw packet data to uncover malicious activity and collaborating with incident response teams to contain and eradicate threats.
Candidates must hold an active DoD Secret clearance, though Top Secret is preferred.
Location Work is to be performed on-site and must have willingness and ability to perform shift work (shifts may not be static).
There are three available shifts: 7am-3pm, 3pm-11pm, and 11pm-7am.
Salary $95,000 to $125,000
Primary Responsibilities:
Investigate alerts generated from endpoints, IDS/IPS, NetFlow data, and custom sensors to detect compromises on customer networks.
Analyze extensive log files, pivot between diverse datasets, and correlate evidence to support incident investigations, creating detailed technical reports outlining your findings.
Monitor and analyze DoD and open-source intelligence feeds to identify Indicators of Compromise (IOCs) and integrate them into security sensors and SIEMs.
Report security incidents to customers and USCYBERCOM, ensuring timely communication and coordinated response.
Required Qualifications:
Active DoD Secret clearance or above.
DoD 8140 IAT level II or higher certification, such as CompTIA Security+ CE, CySA+, ISC2 SSCP, SANS GSEC prior to starting.
DoD 8140 CSSP-A level Certification, such as CEH, CySA+, GCIA, or other certification, is required within 180 days of hire.
Strong foundation in networking, including packet analysis, common ports and protocols, and traffic flow. Knowledge of the OSI model, defense-in-depth security principles, and common security elements for effective threat detection, analysis, and mitigation as a SOC Security Analyst.
Education and experience requirements:
Level I: Bachelor's degree and 1+ years of relevant experience; equivalent work experience and/or military service may be considered in lieu of a degree.
Level II: Bachelor's degree and 3+ years of relevant experience; equivalent work experience and/or military service may be considered in lieu of a degree.
Proven ability to work effectively both independently and as a collaborative team member, demonstrating initiative and a strong work ethic in both settings.
Committed to continuous learning and self-improvement in the cybersecurity domain, as evidenced by ongoing pursuit of certifications, active participation in industry forums, and dedication to staying ahead of emerging threats and technologies.
Excellent problem-solving skills, including the ability to collaborate effectively with cross-functional teams to address complex security challenges in real-world scenarios. This includes the ability to communicate technical information clearly and concisely, build consensus, and drive solutions to completion.
Reliable and flexible, with a demonstrated willingness to work assigned shifts to support operational requirements and team objectives.
Located within a commutable distance to Scott AFB, IL.
Preferred Qualifications:
Hands-on experience analyzing large volumes of logs, network data (e.g., Netflow, Full Packet Capture), and other attack artifacts during incident investigations.
In-depth experience using a SIEM/SOAR platform to analyze multiple log types and events across various data points, applying techniques such as behavioral analysis, statistical analysis, and machine learning to detect and respond to advanced threats.
Comprehensive understanding of the network threat lifecycle, attack vectors, and methods of exploitation, including intrusion set tactics, techniques, and procedures (TTPs).
Experience with Anti-Virus, HIPS/HBSS, IDS/IPS, Full Packet Capture, and Network Forensics tools.
Experience or knowledge in monitoring, defending, or administering cloud networks (e.g., AWS, Azure, GCP), including cloud-native security tools and strategies for protecting data in cloud environments. Experience identifying and mitigating cloud-specific attacks.
Experience managing, defending, administering, or deploying mobile devices (iOS, Android) for enterprise, including mobile device management (MDM), mobile application management (MAM), and mobile threat defense (MTD). A strong understanding of mobile security best practices and mobile threat landscape is highly desired.
Scripting and programming skills.
Who We Are… Newberry Group is a performance-driven government services and solutions firm that provides security compliance, program governance, consulting, and customized solutions for public sector clients nationwide. The strength of our company is a direct reflection of our highly skilled and talented workforce.
Benefits and Perks
In addition to competitive wages, Newberry Group offers an outstanding benefits package. This includes medical coverage with two plan options (HDHP or PPO), dental and vision coverage, personal time off, paid holidays, parental leave program, telecommuting if available, retirement savings accounts (Pre Tax and Roth), flexible and dependent care savings accounts, life insurance, long and short-term disability coverage, tuition and training reimbursement, and employee assistance program.
The Newberry Group, Inc. is an Equal Opportunity Employer – EEO/AA/Disability/Veterans.