5+ years in cyber defense operations or related field within DoD/Intelligence Community
Active TS/SCI clearance required
High School Diploma or GED
8140 IAT Level 1 CND & GCFA certified
Familiarity with cyber security frameworks like Cyber Kill Chain and MITRE ATT&CK
Understanding of computer architectures and networking protocols
Self-motivated with minimal supervision required
Responsibilities
Conduct near real-time network security monitoring and intrusion detection analysis
Review IDS/IPS alerts according to Operating Instructions
Perform host security monitoring and event analysis
Develop and maintain monitoring procedures for hosts/systems
Analyze security sensors and logs for intrusion detection
Correlate suspicious events with network data and external resources
Record details of suspicious activities for further investigation
Triage alerts and logs for accurate decision-making
Enter event data into mission support systems
Escalate security incidents following established protocols
Generate mission reports and provide knowledge transfer to subsequent crews
Support AF field units with computer security-related issues
Benefits
24x7x365 mission operations with rotating crew schedules
Opportunity to work within a critical defense environment
Engagement with advanced security technologies
Collaboration with experienced cyber defense professionals
Potential for career advancement within the Air Force structure
Full Job Description
The Cyber Defense Operator (CDO) supports the Air Force Computer Emergency Response Team (AFCERT) mission by providing continuous, near real-time network security monitoring, intrusion detection analysis, and host security monitoring across the Air Force Information Network (AFIN). The CDO operates as a member of the DCO Hunt and Assess Crew (HAC) and is required to attain and maintain Mission Ready (MR) status in accordance with applicable Air Combat Command Instructions (ACCI) and ACCMANs governing the AFIN weapon system. This position supports 24x7x365 mission operations across rotating crew schedules.
Submit your resume today!
Job Responsibilities
Conduct near real-time network security monitoring and intrusion detection analysis across networks and systems
Review IDS/IPS alerts per Operating Instruction (OI) and checklists
Conduct host security monitoring, alert review, intrusion detection analysis, and event analysis and triage
Develop, Review and Maintain procedures related to the overall monitoring of Hosts/Systems.
Monitor security sensors to analyze Intrusion Detection Systems (IDS) and Security Information and Event Management (SIEM) to identify and correlate security issues/events and review logs to identify intrusions for remediation.
Correlate suspicious events with network events, if possible, and data stored within databases and other external DoD resources.
Analyze traffic/logs/events to determine the necessity for higher level analysis and conduct an initial assessment of type and extent of intruder activities.
Record who, what, where, why and when for any identified suspicious activity in case management system (CMS) to enable additional investigations.
Conduct triage of suspicious activity alerts and logs in order to make a fast and accurate triage decision.
Enter event data into mission support systems in accordance with operational procedures and reports.
Escalate security incidents using established policies and procedures.
Generate end of mission reports (MISREPS) and provide pass-on information for knowledge transfer to subsequent /crews of analysts on duty regarding the latest suspicious traffic seen from a given port, Internet Protocol (IP), etc.
Provide computer security-related support to AF field units.
Provide feedback on detection mechanisms that are both true and false positive events to Content Development as applicable.
Required Qualifications
A minimum of five (5) years of experience in cyber defense operations, network security monitoring, intrusion detection analysis, or a related discipline within a DoD or Intelligence Community environment.
Active TS/SCI clearance required.
High School Diploma or GED required.
8140 IAT Level 1 CND & GCFA certified
General knowledge of cyber security frameworks, such as the Cyber Kill Chain, MITRE ATT&CK, and the NIST 800 series
General knowledge of physical computer components and architectures, including the functions of computer domains, directory services, various components and peripherals, basic programming concepts, assembly codes, TCP/IP, OSI models, underlying networking protocols (e.g., DNS, ARP, etc.), security hardware and software
Candidate must be self-motivated and able to perform with minimal supervision
Preferred Qualifications
Knowledge of cyber forensic collection, preservation, and chain of custody
Prior AFCERT / DCO / SOC experience supporting government networks.
Experience with endpoint and network security tooling such as SIEM, EDR, packet capture, IDS/IPS, and case management workflows.
Familiarity with producing operational deliverables in a regulated environment (formal ticketing, incident timelines, evidence handling).
