This cybersecurity technical resource role is responsible for providing technical analytical oversight to a team of SOC Analysts. The role involves monitoring, detecting, analyzing, remediating, and reporting on cybersecurity events and incidents impacting the technology infrastructure of the Government of the District of Columbia. The ideal candidate will have an advanced technical background with significant experience in an enterprise, successfully leading a SOC team or unit responsible for analysis and correlation of cybersecurity event, log, and alert data.
Responsibilities
Utilize advanced technical background and experience in information technology and incident response handling to scrutinize and provide corrective analysis to escalated cybersecurity events from Tier 2 analysts—distinguishing these events from benign activities, and escalating confirmed incidents to the Incident Response Lead
Provide in-depth cybersecurity analysis, and trending/correlation of large data-sets such as logs, event data, and alerts from diverse network devices and applications within the enterprise to identify and troubleshoot specific cybersecurity incidents, and make sound technical recommendations that enable expeditious remediation
Proactively search through log, network, and system data to find and identify undetected threats
Support security tool/application tuning engagements with analysts and engineers to develop/adjust rules and analyze/develop related response procedures, and reduce false-positives from alerting
Identify, verify, and ingest indicators of compromise and attack (IOC’s, IOA’s) (e.g., malicious IPs/URLs, etc.) into network security tools/applications to protect the Government of the District of Columbia network
Quality-proof technical advisories and assessments prior to release from SOC
Coordinate with and provide expert technical support to enterprise-wide technicians and staff to resolve confirmed incidents
Report common and repeat problems, observed via trend analysis, to SOC management and propose process and technical improvements to improve the effectiveness and efficiency of alert notification and incident handling
Formulate and coordinate technical best-practice SOPs and Runbooks for SOC Analysts
Respond to inbound requests via phone and other electronic means for technical assistance, and resolve problems independently
Coordinate escalations with Incident Response Lead and collaborate with internal technology teams to ensure timely resolution of issues
Requirements
Bachelor's Degree in Cyber Security or related area with minimum five years of demonstrated operational experience as a cybersecurity analyst/engineer handling and coordinating cybersecurity incidents and response in critical environments, and/or equivalent knowledge in areas such as; technical incident handling and analysis, intrusion detection, log analysis, penetration testing, and vulnerability management
Millions of jobs, with real people getting hired every day
200,000+
New jobs added daily
7,000,000+
Verified job listings
1,000,000+
Tailored applications submitted
In-depth understanding of current cybersecurity threats, attacks and countermeasures for adversarial activities such as network probing and scanning, distributed denial of service (DDoS), phishing, ransomware, botnets, command and control (C2) activity, etc.
In-depth hands-on experience analyzing and responding to security events and incidents with most of the following technologies and/or techniques; leading security information and event management (SIEM) technologies, intrusion detection/prevention systems (IDS/IPS), network- and host-based firewalls, network access control (NAC), data leak protection (DLP), database activity monitoring (DAM), web and email content filtering, vulnerability scanning tools, endpoint protection, secure coding, etc.
Strong communication, interpersonal, organizational, oral, and customer service skills
Strong knowledge of TCP/IP protocols, services, and networking
Knowledge of forensic analysis techniques for common operating systems
Adept at proactive search, solicitation, and detailed analysis of threat intelligence (e.g., exploits, IOCs, hacking tools, vulnerabilities, threat actor TTPs) derived from open-source resources and external entities, to identify cybersecurity threats and derive countermeasures, not previously ingested into network security tools/applications, to apply to protect the Government of the District of Columbia network
Excellent ability to multi-task, prioritize, and manage time and tasks effectively
Ability to work effectively in stressful situations
Strong attention to detail
Bachelor’s degree in information technology or related field or equivalent experience
Nice to have:
Undergraduate degree in computer science, information technology, or related field
SANS GCIA, GCED, GPEN, GCIH or similar industry certification
Important Details
Interview: Webcam or in person
About the Company
Derex Technologies Inc specializes in providing IT consulting, staffing solutions and software services. Globally headquartered in Harrison New Jersey since 1996, Derex delivers high-quality technology professionals and customized IT talent solutions to global clients throughout North America. With over two decades of experience, Derex supports clientele across industries such as Systems Integration, Banking and Finance, Telecommunications, Pharmaceutical and Life Sciences, Energy, Healthcare, Technology, Transportation, and local and federal Government agencies.
