S

Solutions³

Cybersecurity, ITOM, ITSM consulting and training

Network Based Systems Analyst 4

Security Operations & Incident ResponsePosted on Nov 13
Full-timeArlington County, Arlington, VA, USA$112k - $131k /yr

About the Job

Requirements

  • At least 8 years of directly relevant experience.
  • At least 3 years of experience evaluating and implementing new cyber response or network forensic capabilities.
  • Hands-on incident response or network operations experience involving enterprise edge devices from at least two of Cisco, Ivanti, Palo Alto, Ciena, and Juniper.
  • Strong understanding of network architecture and security, including routing, switching, virtual private networks, firewalls, segmentation, and defense in depth.
  • Knowledge of Computer Network Defense policies, procedures, and regulations relevant to U.S. government or similar environments.
  • Ability to characterize and analyze network traffic to identify anomalous activity and potential threats.
  • Ability to identify and analyze anomalies in network traffic using metadata such as flow records, DNS logs, and proxy logs.
  • Ability to reconstruct malicious activity based on network traffic and device logs.
  • Understanding of general attack stages, including reconnaissance, initial access, lateral movement, and exfiltration, and how they manifest across networks.
  • Understanding of system and application security threats and vulnerabilities and how they appear in network traffic.
  • Understanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior.
  • Proficiency with common operating systems, such as Linux/Unix and Windows.
  • Experience performing cyber incident response, including scoping, containment, eradication, and recovery, in operational environments.
  • Ability to think independently, make sound decisions under pressure, and work with limited guidance.
  • Written and oral communication skills to explain technical issues clearly to technical and non-technical stakeholders.
  • Ability to work collaboratively across physical locations and within distributed teams.
  • Skill in identifying different classes of attacks and attack stages and translating findings into actionable recommendations.
  • Ability to quickly configure network taps, packet brokers, SPAN ports, and unmanaged or managed switches without disrupting live production or air-gapped traffic.
  • Bachelor’s degree in Computer Science, Cyber Security, Computer Engineering, or a related degree; alternatively, a high school diploma and at least 10 years of technical experience in the area of expertise.
  • Must be a U.S. citizen and hold an active TS/SCI clearance; must be able to obtain DHS Suitability before starting employment.

Responsibilities

  • Serve as a hunt and incident response subject matter expert, applying in-depth knowledge of threat actor tools, techniques, and procedures, with a focus on network-centric and edge-device compromises.
  • Serve as an incident response expert supporting a technology insertion team by evaluating and integrating new network forensic and monitoring capabilities.
  • Assist the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.
  • Assist the Government lead by interfacing with the customer while onsite and communicating status, findings, and recommendations.
  • Characterize and analyze network traffic, including packet captures, flow data, and device logs, to identify anomalous activity and potential threats to network resources.
  • Identify and analyze network traffic anomalies using metadata such as flow records, DNS logs, and proxy logs to detect and scope malicious activity.
  • Reconstruct malicious attacks or activities based on network traffic, including timelines, attacker paths, and data-exfiltration patterns.
  • Examine network topologies to understand data flows, trust boundaries, and potential choke points, and use this understanding to inform hunting and response activities.
  • Assess network topology and device configurations, identify critical security concerns, and recommend security best practices for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
  • Determine appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions.
  • Apply defense-in-depth principles and knowledge of general attack stages to evaluate and improve network security architecture and edge-device configurations.
  • Apply network-device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation.
  • Lead analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.
  • Provide expert support, analysis, and research with broad direction on exceptionally complex problems and processes related to hunt and incident response activities.
  • Serve as a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents.
  • Determine technical objectives with considerable latitude and independently develop creative technical solutions to complex problems.
  • Analyze incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
  • Advise technical personnel on implementing and customizing countermeasures, such as firewall rules, IPS signatures, and access control lists.
  • Support internal stakeholders on containment and eradication missions, onsite and remotely.
  • Preserve evidence integrity according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
  • Assist with writing and publishing Computer Network Defense guidance and detailed reports on incident findings for appropriate audiences.
  • Distill analytic findings into executive summaries and in-depth technical reports for leadership and highly technical audiences.
  • Document analysis, threat actor tools, techniques, and procedures, and device-specific incident-handling procedures in a standardized knowledge base for sharing and publication.
  • Assist in maintaining branch process and procedure documentation and guide the completion of hunt and incident response activities.

Desired Qualifications

  • Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
  • Network and system administration experience in large or complex enterprise or service-provider environments.
  • Strong understanding of adversarial tools, techniques, and procedures, including MITRE ATT&CK, and operational threat environments such as script kiddies, non-nation-state adversaries, and nation-state actors.
  • Knowledge of defense-in-depth and zero-trust principles and their application to network and edge-device architectures.
  • Knowledge of system and application security threats and vulnerabilities, such as buffer overflow, mobile code, cross-site scripting, injections, race conditions, covert channels, replay, return-oriented programming, and malicious code.
  • Knowledge of network-device integrity verification and monitoring approaches.
  • Hands-on skill in host/network intrusion detection and event correlation across multiple telemetry sources, including firewalls, intrusion detection/prevention systems, endpoint tools, and security information and event management systems.
  • Experience analyzing malicious activity, including network beaconing, command-and-control activity, and data-exfiltration detection.
  • Experience with Identity and Access Management tools and their integration into network and edge-security architectures.
  • Ability to review and analyze Enterprise Architecture from a security perspective and recommend architecture-level improvements.
  • Ability to collaborate with stakeholders at multiple organizational levels, including technical staff, management, and senior leadership.
  • Field diagnostics and cyber forensics skills, including running preloaded analysis stacks, using protocol parsers such as Modbus, DNP3, and OPC UA, vulnerability scanning, and local packet capture at line rate.
  • Ability to pack, secure, and transport ruggedized cases such as Pelican or Nanuk cases within standard weight and carry-on or air-transport limits.
  • Preferred certifications include IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder, CEH, SANS GIAC GCIA or GNFA, SANS GRID, GICSP, or GCIP.
  • Highly desired vendor or network certifications include Cisco CCNA or higher (CCNP Security or CCNP Enterprise), and vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti, such as PCNSE or JNCIS/JNCIP.

About the Company

Solutions³

Cybersecurity, ITOM, ITSM consulting and training

Solutions³ provides cybersecurity, IT operations management (ITOM), and IT service management (ITSM) consulting and training, with implementation supported by industry-standard practices. It works through a people–process–technology lifecycle that includes advisory services, training, and deployment of market-ready applications, in partnership with the DVMS Institute to Create, Protect, Deliver, and Verify Trusted Digital Business value. It stands apart by combining a formal, standards-driven end-to-end approach with recognized accreditations (APMG International, UK NCSC/GCHQ, DHS/CISA) and a collaborative methodology that yields clearly defined, executable projects aligned to client objectives. Its goal is to help organizations of any size manage digital risk, improve resiliency, and create value from digital services through governance, training, and proven implementation practices.

Company size
1-10
Company stage
Not listed
Total funding
Not listed
Headquarters
Wyckoff, NJ
Founded
2003

Recently Posted Jobs

Explore more opportunities at Solutions³

See more jobs