Today
Public Trust
Unspecified
Unspecified
IT - Security
herndon, AL (On-Site/Office)
GENERAL DUTIES:
REQUIRED QUALIFICATIONS:
DESIRED QUALIFICATIONS:
CLEARANCE:
- Integrate/analyze/tune feed of threat observables related to cyber threats that have the potential to impact CoPA industry (the Threat Observables Feed) into the SIEM platform to support our security threat monitoring.
- Provide CoPA with notifications and reports on new and / or emerging security threats that have the potential to impact CoPA infrastructure. The Threat Reports will describe:
- Major threats, threat landscapes, trends, attack vectors, and associated indicators to support threat monitoring in CoPA's environment.
- Suggested Courses of Action (COAs) to mitigate the identified potential security threats.
- Perform threat hunting by reviewing threat intelligence feeds and analyzing system alerts using the native capabilities of the SIEM. Threat Hunting activities include:
- Researching threats identified by threat intelligence sources using the standard functionality of the SIEM that includes data sources such as firewall, web proxy, and Domain Name Services (DNS).
- Performing SIEM Use Case/Hypothesis development. It is defined as a specific supposition regarding suspicious files / processes / threat actors to identify previously undetected active threats to CoPA's in-scope infrastructure.
- Provide CoPA stakeholders with the threat advisories (description of the threat vector, potential impacts, and suggestions to reduce impact or implement safeguards) upon identification of a potential security threat that may impact the infrastructure.
- Perform corrective actions (if any) for security alerts and threat advisories triggered on SOC managed devices when necessary.
REQUIRED QUALIFICATIONS:
- 5 or more years work experience with performing cyber hunt activities within cloud or on-premise environments
- Cybersecurity countermeasures and mitigation strategies work experience
DESIRED QUALIFICATIONS:
- Relative academic degree or technical certification within Cyber Hunting or Digital Forensics
- Incident Response (System or Network Threat Triaging)
- Penetration Testing
CLEARANCE:
- US Citizenship required with the ability to pass a background investigation for the Commonwealth of Pennsylvania
group id: 90943786
