REQ#: RQ72132 Cyber Operations Engineer with TS/SCI Clearance (Open)
Travel Required: None
Requisition Type: Regular
We are GDIT. The people supporting and securing some of the most complex government defense and intelligence projects across the country. We ensure today is safe and tomorrow is smarter. Our work has meaning and impact on the world around us, but also on us, and that's important.
GDIT is your place. You make it your own by embracing autonomy, seizing opportunity, and being trusted to deliver your best every day. We think. We act. We deliver. There is no challenge we can't turn into opportunity. And our work depends on TS/SCI level cleared Cyber Operations Engineer joining our team to support our Intel customer.
Cyber Security Operations Engineer will operate and manage all aspects of Information Systems, data availability, integrity, authentication, confidentiality, and non-repudiation. This role will develop and execute security policies, plans, and procedures and ensure security measures of the network.
Provide cyber threat intelligence services for the collection, fusion, analysis, creation, and distribution of threat intelligence from government entities, commercial feeds, open sources, and other partners to obtain situational awareness of the threat environment.
Provide cyber threat intelligence services on an expanded 12x5 service support level during core hours and on-call support with two-hour response time during non-core hours.
Cyber threat intelligence services shall develop and disseminate reports and tippers to internal and external stakeholders based on events, alerts, and incidents on customer systems and networks.
Implements and monitors security measures for communication systems, networks, and provide advice that systems and personnel adhere to established security standards and Governmental requirements for security on these systems.
Designs and implements data network security measures; operates Network Intrusion Detection and Forensics; conducts performance analysis of Information Systems security incidents; develops Continuity of Operation (COOP)/Disaster Recovery (DR) plans and supports certification of Information Systems and Networks.
Supervises operation of Electronic Key Management System, other information security duties, and Public Key Infrastructure.
Receive tickets from other Cybersecurity Operations Services sub-services and conduct detailed analysis to validate any event/alert/incident
Categorize, prioritize, investigate, and assess cybersecurity events/alerts/incidents to identify the extent and scope of the event/alert/incident and what impact there is on the operation or systems
Update and forward tickets to other Cybersecurity Operations Services to customer as needed
Collect, aggregate, and analyze artifacts and evidence from all available tools, knowledge sources, and data artifacts to determine and document the who, what, when, where, why and how of an intrusion, its extent, how to limit damage, and how to recover
Submit custom signatures and tuning requests as needed to Network Security Services, Endpoint Security Services, and Cybersecurity Data Analysis Services
Assists the C-IRT by assessing ongoing incident activity to predict adversary responses and locations of compromise
Documents tickets and analysis to a level of detail sufficient to reconstruct the analyst’s analysis, to include but not limited to the steps taken, timelines, and data required to justify the analyst’s assessment
Provide custom metrics reports including incident category types, tools used, number of indicators, time opened at each step, trending statistics, service availability, system utilization, etc.
Provide input to the daily CSOC Significant Activity, Operations, and the weekly CSOC Status Report
Advanced Cybersecurity Analytics, coordinate with Network Security Services, Endpoint Security Services, and Cybersecurity Data Analysis Services to develop or tune rules/signatures/scripts
2+years of relevant experience and a Bachelor’s Degree or equivalent years of experience and education
DoD 8570.01-M IAT Level II certification and CSSP Analyst.
Utilize the SEIM to perform 24/7 monitoring, detection, and initial triage (identify, investigate, categorize, prioritize, ticketing, and forwarding) of events/alerts/incidents.
Experience with Cyber Incident Response Team (C-IRT) Services
Cyber Incident Quality Control Services - Conduct Quality Control reviews of a percentage closed Tier II tickets each week to ensure proper analysis, categorization, documentation, and notification
Cyber Threat Emulation Services; Develop, test, and when properly authorized, execute custom scripts, programs, and/or other capabilities to emulate cyber threats to include Cyber Data Presentation Services
Cyber Hunt Services/Planned Hunt Services; update, and document tickets in the authorized ticketing system to initiate the incident response.
TS/SCI Security Clearance and eligibility to obtain CI Poly