Description

Job ID 2315524-FLEXWORK-VA

Location REMOTE WORK, VA, US

Date Posted 2023-11-15

Category Cyber

Subcategory Cybersecurity Ops

Schedule Full-time

Shift Day Job

Travel No

Minimum Clearance Required None

Clearance Level Must Be Able to Obtain None

Potential for Remote Work No

Description

SAIC is seeking a Cybersecurity Specialist to join our team providing Cybersecurity services for a major state & local government customer located in Texas. This position reports to our Cybersecurity Operations Director and is a member of the 24x7x365 security operations (SecOps) team. This analyst will have two primary categories of responsibilities being a technical leader in the incident response and command function and assisting with SIEM administration and engineering. During your tenure, you will learn the technical aspects of running and maintaining a SIEM, such as getting data in, authoring and tuning correlation rules, developing dashboards and reports, ensuring endpoints that are expected to send their logs are actually doing so, and other similar activities. Your primary responsibility will be incident response including how to prepare, detect, respond/contain, mitigate/eradicate, report on, recover from, remediate, and learn from cybersecurity events and incidents in the enterprise. This includes authoring, modifying, and maintaining our internal SOC playbook and associated procedures, as well as have rotating on-call responsibilities.

Primary Job Responsibilities Include
• Driving progress on incident ticket resolution, including, but not limited to
• Identifying root cause of issue,
• Contain ongoing threats,
• Directing partner technical service providers in tasks which restore affected systems to their secure baseline,
• Coach, guide, and mentor more junior SOC analysts
• Cyber Threat Intelligence (CTI) collection, analysis, production, and dissemination.
• Assist SIEM engineering with project-based and routine activities associated with
• Getting data into the SIEM,
• Developing dashboards and reports,
• Authoring new and/or tuning existing correlation rules,
• Maintaining oversight of endpoint logging.
• Provide analysis and reporting of security events and investigations.
• Coordinate and collaborate with peer technical teams in a multi-vendor environment
• Perform Advanced Threat Hunting using automated scanning tools and manually by performing Hypothesis Based Threat Hunting activities
• Perform Digital Forensic acquisition of data and associated investigation & analysis
• Log security incidents in the ITSM ticketing system
• Manage security incidents throughout their lifecycle to resolution
• Provide support for routine reporting

Support ad-hoc data and investigation requests

Qualifications

Experience, Education and Certification

Required
• Bachelor’s degree in a relevant field of study (e.g. Cybersecurity, Information Systems, Computer Science, or other relevant business or IT field).
• Excellent oral and written communication skills, including confident and concise oral communications used in leading Security Incident Response Team (SIRT) calls
• Familiarity with syslog-based logging server-side configurations
• Experience with Microsoft Office including Word and PowerPoint
• Obtain the Cybersecurity First Responder certification within 180 days of first day of employment

Preferred
• Experience with ITIL, ITIL certification
• Unix/Linux and/or Windows System Administration
• Familiarity with syslog-based logging client-side configurations
• Demonstrated experience with Microsoft Sentinel, Azure Event Analytics, Lighthouse, and other similar and supporting technologies; Current Microsoft security-related certification holders will be given strong preference
• Demonstrated experience with EnCase Digital Forensics/Investigator and Endpoint Security solutions; Current EnCE certification holders will be given strong preference
• CISSP, SANS/GIAC, and other industry-recognized cybersecurity certification(s)
• Experience and familiarity with Cyber Threat Intelligence (CTI) programs, including indicators of attack, compromise, etc., and associated actions to take to detect and block relevant ones
• Experience with cloud security concepts within AWS, Azure, GCP, and/or OCI environments

What We Will Provide
• On the job training of the customer environment and tools
• A strong teamwork-based environment that enables close collaboration and support of each other
• A flexible approach to work schedule

What We Expect From You
• Passion, personality, and persistence – you should provide the drive to learn and grow, while we provide the technical knowledge
• You must be able to provide on-call coverage on both a planned rotation and ad-hoc when issues arise, particularly after training is complete

Continual learning – you must be willing to continue to learn and grow through acquisition and application of additional coursework toward a degree program and/or certifications. SAIC will provide reimbursement for a portion of or the entirety of the costs associated with these.

Target salary range $100,001 - $125,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.

Covid Policy SAIC does not require COVID-19 vaccinations or boosters. Customer site vaccination requirements must be followed when work is performed at a customer site.

Responsibilities

• This analyst will have two primary categories of responsibilities being a technical leader in the incident response and command function and assisting with SIEM administration and engineering
• During your tenure, you will learn the technical aspects of running and maintaining a SIEM, such as getting data in, authoring and tuning correlation rules, developing dashboards and reports, ensuring endpoints that are expected to send their logs are actually doing so, and other similar activities
• Your primary responsibility will be incident response including how to prepare, detect, respond/contain, mitigate/eradicate, report on, recover from, remediate, and learn from cybersecurity events and incidents in the enterprise
• This includes authoring, modifying, and maintaining our internal SOC playbook and associated procedures, as well as have rotating on-call responsibilities
• Driving progress on incident ticket resolution, including, but not limited to
• Identifying root cause of issue,
• Contain ongoing threats,
• Directing partner technical service providers in tasks which restore affected systems to their secure baseline,
• Coach, guide, and mentor more junior SOC analysts
• Cyber Threat Intelligence (CTI) collection, analysis, production, and dissemination
• Assist SIEM engineering with project-based and routine activities associated with
• Getting data into the SIEM,
• Authoring new and/or tuning existing correlation rules,
• Maintaining oversight of endpoint logging
• Provide analysis and reporting of security events and investigations
• Coordinate and collaborate with peer technical teams in a multi-vendor environment
• Perform Advanced Threat Hunting using automated scanning tools and manually by performing Hypothesis Based Threat Hunting activities
• Perform Digital Forensic acquisition of data and associated investigation & analysis
• Log security incidents in the ITSM ticketing system
• Manage security incidents throughout their lifecycle to resolution
• Provide support for routine reporting
• Support ad-hoc data and investigation requests

Qualifications

• Clearance Level Must Be Able to Obtain None
• Experience, Education and Certification
• Bachelor’s degree in a relevant field of study (e.g
• Cybersecurity, Information Systems, Computer Science, or other relevant business or IT field)
• Excellent oral and written communication skills, including confident and concise oral communications used in leading Security Incident Response Team (SIRT) calls
• Familiarity with syslog-based logging server-side configurations
• Experience with Microsoft Office including Word and PowerPoint
• Obtain the Cybersecurity First Responder certification within 180 days of first day of employment
• Passion, personality, and persistence – you should provide the drive to learn and grow, while we provide the technical knowledge
• You must be able to provide on-call coverage on both a planned rotation and ad-hoc when issues arise, particularly after training is complete
• Continual learning – you must be willing to continue to learn and grow through acquisition and application of additional coursework toward a degree program and/or certifications

Educational Requirements

• Bachelors Degree

Benefits

• A flexible approach to work schedule
• SAIC will provide reimbursement for a portion of or the entirety of the costs associated with these
• Target salary range $100,001 - $125,000
• The estimate displayed represents the typical salary range for this position based on experience and other factors