Location
Reston, VA | United States
Job description
Description
SAIC has an opportunity for a Cyber Incident Response Team analyst to support the US Army Corps of Engineers Revolutionary IT Services (USACE RITS) program.
This position will be 100% remote and can be performed anywhere in the United States.
The USACE RITS contract will provide modern and secure enterprise-wide IT support services to approximately 37,000 USACE customers located throughout the CONUS and OCONUS. Services will support the mission needs of USACE’s Headquarters (HQs) located in Washington, D.C., nine Divisions and 43 Districts, to include over 1,500 field and area project offices and two data centers that are currently located in Vicksburg, Mississippi, and Hillsboro, Oregon.
The ideal candidate will be the point of contact for monitoring agency networking environments, including cloud, DMZs and secure LANs, as required by the USACE OCIO/G-6. The service shall also support connectivity to extranets and the internet.
Major duties with monitoring include:
- Providing analysis and monitoring for all systems and environments to ensure the availability, integrity, and confidentiality of the data processed, stored, and transmitted via a centralized support monitoring service. Analysis and monitoring shall be automated to the maximum extent possible.
- Providing Intrusion Detection System/Intrusion Prevention System (IDS/IPS) support:
- Implementing, administering, and maintaining threat sensors based on current threat directives and recommendations.
- Developing, testing, and distributing threat sensor baseline signatures.
- Developing IDS/IPS test plans, operational procedures, and maintenance plans.
- Providing host-based intrusion detection monitoring and prevention on all devices, including those supporting Host-Based Security Systems (HBSSs).
- Providing data feeds from all intrusion detection and prevention modules for incorporation into the Enterprise Security Incident Management System, for CorpsNet, cloud, DMZ, and SIPR in accordance with classification guidance.
- Providing continuous monitoring of malware protection and detection mechanisms.
- Providing administrator access to the designated Government POCs as required.
- Providing active monitoring of the operational status, health, and performance of the monitoring tools and devices.
- Actively monitoring vendor feeds, Army feeds, tippers, OPORDS, sensor grids, and intelligence feeds for new signature information.
- Analyzing the information provided and providing recommendations for inclusion into the CorpsNet, and SIPRNet environments, while maintaining the classification of information.
- Providing performance measurements, logs, and information feeds from the security monitoring systems (e.g., HBSS and IPS).
- Maintaining access to current network architecture diagrams per DISA standards showing placement of sensors (e.g.,IDS/IPS, Routers, Netflow/PCAP systems, firewall, etc.).
- Reporting on access to assets, including, but not limited to, network and host-based sensors for CorpsNet, CorpsNet extended network (JRSS and cloud), and SIPRNet.
- Integrating and correlating data from USACE systems, servers, services, SIEM, and end points to measure, monitor, remediate, and remove threats to the environment in accordance with USACE OCIO/G-6 directives. Major incident response duties include: 0. Responding to alerts and violations identified, in accordance with cyber policy and incident response plans, as part of the SIEM.
Qualifications
Education:
- Bachelors and two (2) years or more experience; additional four (4) years experience in lieu of degree.
Experience:
- Identifying incident threat level and nature based on the received alert or violation.
- Identifying root cause, source, and methodology used to properly categorize the incident.
- Providing AR 380-53 Network Damage Assessment, if necessary.
- Gathering host logs from compromised system(s).
- Taking corrective action to contain the incident, prevent further spread, and protect systems.
- Providing forensically sound evidence collection and capabilities.
- Eradicating the malicious event from infected hosts/network as directed by USACE OCIO/G-6.
- Providing cyber clean-up as required, including the restoration of damaged data.
- Recommending mitigating actions to prevent future infections or reinfection.
- Configuring and fine-tuning detection/prevention capabilities.
- Providing cyber After Action Reports (AARs), including lessons learned and final network damage assessment as identified by USACE OCIO/G-6.
- Providing analysis, correlation, and trending of anomalous events and incidents.
- Supporting incident response team deployment to USACE OCIO/G-6 locations.
- Coordinating and sharing data with other Federal agencies and DoD commands as directed by USACE OCIO/G-6.
- Providing analysis and reverse engineering of cyber threats.
- Implementing mitigation measures in response to general or specific threats on the respective networks in accordance with USACE OCIO/G-6 directives.
CERTIFICATION REQUIRED: Must have at least one of the following
- CEH – Certified Ethical Hacker
- CySA+ - Cybersecurity Analyst Plus
- GICSP - GIAC Global Industrial Cyber Security Professional
- SSCP - Systems Security Certified Practitioner
- CFR - CyberSec First Responder
CLEARANCE REQUIREMENT:
- Must have an Interim Secret clearance with ability to obtain and maintain a Secret clearance.
SAIC accepts applications on an ongoing basis and there is no deadline.
Covid Policy: SAIC does not require COVID-19 vaccinations or boosters. Customer site vaccination requirements must be followed when work is performed at a customer site.
Job tags
Salary
