Cyber Defense Analyst (2nd Shift)*

Requires US Citizenship Yes
Employment Term and Type: Regular, Full Time
Required Security Clearance: (Minimum for hire) TS/SCI
Required Education: (Minimum for hire) BA/BS in CS, IT, IA or related area of study desired; without a degree 8+ years relevant professional experience in those fields.
Salary Band: $91,085.69 to $104,097.93

Job Description:
FGS, LLC is seeking a Cyber Defense Analyst (2nd Shift) to support the Navy's cybersecurity environment at the Office of Naval Intelligence (ONI) Hopper Global Communications Center (HGCC) in Suitland, Maryland. The selected candidate will provide front-line cyber defense for critical TS/SCI networks by monitoring and investigating cybersecurity alerts, identifying potential threats, and supporting proactive threat-hunting activities.
The Cyber Defense Analyst will apply concentrated Computer Network Defense (CND) experience and knowledge of IT systems and networks to analyze security events, manage incident and event tickets, correlate activity across multiple cybersecurity platforms, support intelligence gathering and analysis, and communicate findings to Government and program stakeholders. This is a second-shift position with regular work hours of [redacted]; occasional floater shifts or coverage outside these hours may be required based on program and staffing needs.

Primary Duties and Responsibilities:

• Perform first-line monitoring and initial analysis of cybersecurity alerts affecting TS/SCI networks, including JWICS, ATLAS, and other networks supported by HGCC.
• Monitor SIEM, NIDPS, host-based security, endpoint, and related cybersecurity tools for alerts, anomalies, indicators of compromise, and suspicious activity.
• Investigate and perform initial technical analysis of cybersecurity alerts and events; document findings and escalate potential incidents to Tier 2 or other responsible personnel as appropriate.
• Create, update, track, and manage cybersecurity incident and event tickets using approved ticketing and case-management systems.
• Conduct proactive threat-hunting activities and correlate security events across multiple platforms to identify malicious activity, emerging threats, patterns, and trends.
• Perform wireless security scans of facilities and document, analyze, and report findings.
• Use CND tools and knowledge of network security architecture, enterprise services, adversary TTPs, malware, and attack vectors to support analysis and investigation.
• Prepare and deliver operational, technical, and situational-awareness briefings and written reports to Government and program stakeholders.
• Support annual cyber defense exercises and development or improvement of CND tactics, techniques, procedures, best practices, manuals, and standard operating procedures.

Required Qualifications:

• U.S. Citizenship.
• Active TS/SCI security clearance at the time of hire.
• BA/BS in CS, IT, IA or related area of study desired; without a degree 8+ years relevant professional experience in those fields.
• Must also have and be able to reflect 5+ years concentrated experience in CND discipline regardless of having a degree or not. 3+ years professional experience in monitoring and investigating alerts from cybersecurity tools, as well as general knowledge of IT systems and networks to assist in threat hunt activities.
• Significant experience with SIEM platforms such as Splunk and Elastic; NIDPS technologies such as Cisco FirePower and Palo Alto NGFW; and host-based tools such as Trellix ePO, Microsoft Defender, and Tanium.
• Knowledge of incident-management lifecycle processes, network security architecture and defense-in-depth concepts, common adversary TTPs, and enterprise services including domain controllers, DNS, email, print, and web servers.
• Working knowledge of network traffic and packet-capture analysis using tools such as Wireshark or NIKSUN, including methodologies for identifying anomalous or malicious network activity.
• Moderate knowledge of identifying and classifying attack vectors and malware; IDS/IPS rule/signature writing and countermeasure development; and firewall and routing rules.
• Moderate knowledge of scripting and programming languages such as Python, Perl, Ruby, JavaScript, PowerShell, C, C++, Java, Visual Basic .NET, PHP, and AJAX.
• Working knowledge of penetration testing and Red Team tactics, techniques, and procedures, including phishing and tools such as Kali Linux, SamuraiWTF, Nmap, Burp Suite, sqlmap, and Metasploit.
• Experience applying Federal, DoD, Intelligence Community, and industry cybersecurity standards to develop CND best practices, manuals, standard operating procedures, and tactics, techniques, and procedures (TTPs).
• Knowledge of ticketing systems, report writing, and cybersecurity intelligence gathering, analysis, and dissemination techniques.
• Strong analytical, conceptual, problem-solving, interpersonal, organizational, documentation, and briefing skills, with the ability to prioritize and execute tasks in a high-pressure environment with limited direction.

Required Certifications:

• Prior to reporting on board, must possess a current industry certification satisfying the DoD Cybersecurity Workforce Improvement Program (DoD 8570.01-M) requirements for CSSP Analyst, consistent with contract requirements.
• Certification must be one accepted for the CSSP Analyst work role under the applicable contract and DoD cybersecurity workforce requirements and must be current prior to reporting on board.

Desired Qualifications:

• Experience supporting Navy, DoD, or Intelligence Community cyber defense operations in a classified environment.
• Experience performing proactive threat hunting, wireless security assessments, cyber defense exercises, packet analysis using Wireshark or NIKSUN, and development of CND TTPs and standard operating procedures.
• Familiarity with Federal, DoD, IC, NIST, SANS, and industry cybersecurity standards and best practices.

Education Requirements:

• BA/BS in CS, IT, IA or related area of study desired; without a degree 8+ years relevant professional experience in those fields.

Security Clearance Requirements:

• U.S. citizenship and an active TS/SCI clearance are required at the time of hire. The employee must maintain clearance eligibility throughout employment.

Physical, Work Environment & Conditions:

• Primarily on site at the Office of Naval Intelligence in Suitland, Maryland.
• Regular second-shift work hours are 1530-2330. Occasional floater shifts or coverage outside normal second-shift hours may be required based on program and staffing needs.
• Work is performed in a professional office and secure-facility environment supporting classified networks and cybersecurity operations.
• Must be able to use standard office and information technology equipment and work at a computer for extended periods.
• Must be able to communicate effectively with technical, mission, program, and senior leadership stakeholders.

This position description is not intended as, nor should it be construed as, exhaustive of all responsibilities, skills, efforts, or working conditions associated with this job. This and all positions are eligible for organization-wide transfer. Management reserves the right to assign or reassign duties and responsibilities at any time.

#cjpost - Cyber