Today
Public Trust
Unspecified
Unspecified
IT - Security
AL (On-Site/Office)
GENERAL DUTIES:
REQUIRED QUALIFICATIONS:
CLEARANCE:
- Integrate/analyze/tune feed of threat observables related to cyber threats that have the potential to impact CoPA industry (the Threat Observables Feed) into the SIEM platform to support our security threat monitoring.
- Provide CoPA with notifications and reports on new and / or emerging security threats that have the potential to impact CoPA infrastructure. The Threat Reports will describe:
- Major threats, threat landscapes, trends, attack vectors, and associated indicators to support threat monitoring in CoPA's environment.
- Suggested Courses of Action (COAs) to mitigate the identified potential security threats.
- Perform threat hunting by reviewing threat intelligence feeds and analyzing system alerts using the native capabilities of the SIEM. Threat Hunting activities include:
- Researching threats identified by threat intelligence sources using the standard functionality of the SIEM that includes data sources such as firewall, web proxy, and Domain Name Services (DNS).
- Performing SIEM Use Case/Hypothesis development. It is defined as a specific supposition regarding suspicious files / processes / threat actors to identify previously undetected active threats to CoPA's in-scope infrastructure.
- Provide CoPA stakeholders with the threat advisories (description of the threat vector, potential impacts, and suggestions to reduce impact or implement safeguards) upon identification of a potential security threat that may impact the infrastructure.
- Perform corrective actions (if any) for security alerts and threat advisories triggered on SOC managed devices when necessary.
- Responsible for generating and investigating leads from Zeek network traffic at Internet Service Provider (ISP) visibility for areas of interest (AOI)
- Subject matter expertise (SME) with APT threat actors and their TTPs
- Experience querying/processing "big data" and building/automating threat hunting workflows (python and AWS skills desirable)
REQUIRED QUALIFICATIONS:
- 10 years of experience and a BS degree.
- Cyber Threat Hunting experience and some experience as a Manager or Technical Lead.
- Experience supporting the DoD or similar agencies as a Cyber Threat Hunter
CLEARANCE:
- Secret minimum
group id: 90943786
