TS/SCI Content Developer - SIEM/SOAR

Required Skills & Experience

• TS/SCI
• GMLE Certification (GIAC Machine Learning Engineer) OR Degree in Computer Science
• More than 5 years of SIEM technology such as ArcSight, Splunk, and/or ELK.
• More than 3 years with network traffic analysis, ports, and protocols. BA/BS or MA/MS
• More than five (5) years of SIEM technology such as Arcsight, Splunk and/or ELK. Including, but not limited to, log handling, reports, filters, rule creation.
• Extensive knowledge with IDS/IPS systems currently in use by the Department of Defense (DoD), Services, and Agencies (i.e., Air Force, Navy, Army, DC3, DISA).
• More than three (3) years of experience with Network Traffic Analysis; ports and protocols. SANS GCDA or equivalent certification(s).
• Extensive knowledge of MITRE ATT&CK framework, and its uses within the cybersecurity community (e.g., Open Source projects)

Job Description

Analyze Defensive Cyber Operations (DCO) events to identify potential threats, vulnerabilities, and malicious activity. Implement and maintain current industry best practices for Security Information and Event Management (SIEM) solutions. Leverage security alerts and enriched log data to improve operators’ ability to accurately identify and respond to legitimate cyber threats. Evaluate the effectiveness of security controls and monitor network activity for unauthorized outbound communications. Analyze enterprise log data to develop and implement effective security detections. (CDRL A007) Build dashboards and visualizations that enable the identification and analysis of adversarial activity. (CDRL A007) Leverage log data to create virtual tripwires that provide early warning of suspicious or malicious activity. Analyze, onboard, and optimize security logs within the SIEM to support efficient platform performance and effective threat detection. Design, implement, test, and maintain SIEM solutions in support of operational requirements. (CDRL A007) Develop and support SIEM use cases, identifying the alerts, data sources, and log enrichment required to achieve acceptable false-positive rates. (CDRL A008) Develop, test, validate, and maintain SIEM filters, detection rules, and associated security content. (CDRL A007) Build and implement event correlation rules, detection logic, and security content within the SIEM environment. (CDRL A007) Tune SIEM correlation rules and detection logic to reduce noise associated with normal network behavior, known false positives, and established errors. Analyze malware activity and behaviors to develop behavioral detections capable of alerting on or preventing malicious activity. Automate SIEM functions and repeatable operational tasks using common programming or scripting languages. Develop scheduled and ad hoc reports using SIEM capabilities and associated security tools. (CDRL A007 and A008) Develop, update, and maintain SIEM-related technical and operational documentation. (CDRL A008) Establish and execute processes for routinely reviewing and maintaining SIEM resources, including rules, filters, lists, trends, dashboards, and reports. Utilize SIEM capabilities to collect and analyze metrics and produce reports in support of operational and leadership requirements. Deliver training to government personnel as required. Provide knowledge transfer related to security tools, operational processes, procedures, and SIEM capabilities to government personnel. Provide on-the-job training (OJT) to contractor, military, and civilian personnel. Maintain continuity documentation and working aids at least quarterly to support effective personnel transitions. Maintain awareness of emerging cybersecurity threats, technologies, and industry trends, and provide operational reports and assessments supporting the development of tactics, techniques, and procedures (TTPs). (CDRL A002) Develop, document, analyze, and report operational metrics designed to improve weapon system processes and overall mission execution. (CDRL A009) Support operational leadership with additional tasking related to Content Development functions, responsibilities, and mission requirements.