Tier 2 IR Night Shift

Requirements:

• Must be a US citizen, no clearance required, prefer Secret Clearance with the ability to obtain TS/SCI.
  
• Bachelor s degree in Science or Engineering Field, IT, or Cybersecurity or related field
  
• 3+ years of experience be in the areas of incident detection and response, remediation malware analysis, or computer forensics.
  
• Must have at least one of the following certifications:SANS GIAC: GCIA, GCFA, GPEN GCFE, GREM, or GCIH ISC2 CCFP, CCSP, CISSP, CERT CSIH EC Council: CHFI, Offensive Security: OSCP, OSCE, OSWP and OSEE Encase: EnCE, DOD 8570: IAT L3, CNDSP Analyst or IR Carnegie Mellon: CSIH - Ability to script in one more of the following computer languages Python, Bash, Visual Basic or Powershell - Must be a US citizen, no clearance required. Must have one of the following: CCFP Certified Cyber Forensics Professional CCNA Security CCNP Security CEH Certified Ethical Hacker CHFI Computer Hacking Forensic Investigator CISSP Certified Information Systems Security CIRC ECES EC-Council Certified Encryption Specialist ECIH EC-Council Certified Incident Handler ECSA EC-Council Certified Security Analyst ECSS EC-Council Certified Security Specialist EnCE ENSA EC-Council Network Security Administrator FIWE GCFA Forensic Analyst GCFE Forensic Examiner GCIH Incident Handler GISF Security Fundamentals GNFA Network Forensic Analyst GREM Reverse Engineering Malware GWEB Web Application Defender GXPN Exploit Researcher and Advanced Penetration Tester LPT Licensed Penetration Tester OSCE (Certified Expert) OSCP (Certified Professional) OSEE (Exploitation Expert) OSWP (Wireless Professional) WFE-E-CI FTK-WFE-FTK CompTIA Cyber Security Analyst (CySA+) CompTIA Linux Network Professional (CLNP) CompTIA PenTest+ GCTI Cyber Threat Intelligence GOSI Open Source Intelligence CTIA Certified Threat Intelligence Analyst Splunk Core Certified Advanced Power User Splunk Core Certified Consultant Splunk SOAR Certified Automation Developer IACRB Certified Security Awareness Practitioner (CSAP)
  

• Experience in Federal Government, DOD or Law Enforcement in CND, IR or SOC role
  
• Cyber Kill Chain Knowledge
  

• US Citizenship is required.
  
• Prefer Secret Clearance with the ability to obtain TS/SCI
  
  

Physical Demands: The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job with or without reasonable accommodation. While performing the duties of this job, the employee will regularly sit, walk, stand and climb stairs and steps. May require walking long distance from parking to work station. Occasionally, movement that requires twisting at the neck and/or trunk more than the average person, squatting/ stooping/kneeling, reaching above the head, and forward motion will be required. The employee will continuously be required to repeat the same hand, arm, or finger motion many times. Manual and finger dexterity are essential to this position. Specific vision abilities required by this job include close, distance, depth perception and telling differences among colors. The employee must be able to communicate through speech with clients and public. Hearing requirements include conversation in both quiet and noisy environments. Lifting may require floor to waist, waist to shoulder, or shoulder to overhead movement of up to 20 pounds. This position demands tolerance for various levels of mental stress.

Job Duties:

• Utilize state of the art technologies such as host forensics tools(FTK/Encase), Endpoint Detection & Response tools, log analysis (Splunk) and network forensics (full packet capture solution) to perform hunt and investigative activity to examine endpoint and network-based data.
  
• Conduct malware analysis, host and network, forensics, log analysis, and triage in support of incident response.
  
• Recognize attacker and APT activity, tactics, and procedures as indicators of compromise (IOCs) that can be used to improve monitoring, analysis and incident response.
  
• Develop and build security content, scripts, tools, or methods to enhance the incident investigation processes.
  
• Lead Incident Response activities and mentor junior SOC staff.
  
• Work with key stakeholders to implement remediation plans in response to incidents.
  
• Effectively investigative and identify root cause findings then communicate findings to stakeholders including technical staff, and leadership.
  
• Flexible and adaptable self-starter with strong relationship-building skills
  
• Strong problem solving abilities with an analytic and qualitative eye for reasoning
  
• Ability to independently prioritize and complete multiple tasks with little to no supervision