Cyber Network Defense Analysts (CNDA) Level II

Cyber Network Defense Analyst (CNDA) - Level II

Argo Cyber Systems, LLC | Federal Cybersecurity Operations

Security Clearance: Active Top Secret / SCI (TS/SCI) Required
Citizenship: U.S. Citizenship Required
Suitability: Must be able to obtain DHS Suitability
Experience Level: Level II / Experienced Cybersecurity Analyst
Work Location: Pensacola, FL
Position Overview

Argo Cyber Systems is seeking a skilled Cyber Network Defense Analyst (CNDA) Level II to support a mission-critical U.S. Government cybersecurity program focused on protecting federal civilian agencies, government networks, and critical infrastructure from sophisticated cyber threats.

In this role, you will provide advanced network security monitoring, threat detection, intrusion analysis, and incident response support using host-based, network-based, and cloud-based cybersecurity technologies.

The ideal candidate possesses hands-on experience analyzing network traffic, identifying suspicious activity, investigating security alerts, and supporting cyber defense operations. You will work alongside experienced cybersecurity professionals to identify malicious activity, investigate potential intrusions, and provide actionable intelligence that strengthens enterprise security.

This position offers an opportunity to directly contribute to national cybersecurity defense missions through proactive threat detection, incident investigation, and continuous monitoring of government information systems.
Key Responsibilities
Network Security Monitoring and Threat Detection

• Monitor and analyze enterprise network traffic to identify anomalous behavior, suspicious activity, and potential cybersecurity threats.
• Review security alerts generated by intrusion detection systems, network monitoring technologies, and other cyber defense platforms.
• Identify and distinguish malicious activity, potential intrusions, and unauthorized behavior from legitimate network operations.
• Correlate security events across multiple data sources to identify patterns of compromise and determine the potential scope of cyberattacks.
• Perform continuous monitoring of enterprise systems and network activity to detect emerging threats.
• Analyze network traffic metadata to identify unusual communications, suspicious connections, and potential indicators of compromise.
• Identify network reconnaissance activities, including network mapping and operating system fingerprinting.

Cyber Incident Analysis and Response

• Investigate and validate cybersecurity alerts to determine their cause, severity, and potential impact on affected systems.
• Coordinate with enterprise cyber defense personnel to confirm security events and support incident response activities.
• Document security incidents, including event history, investigative findings, current status, and potential operational impact.
• Escalate confirmed or suspected cybersecurity incidents according to established incident handling procedures.
• Analyze malicious activity to identify exploited vulnerabilities, attack methods, and potential consequences for systems and information.
• Reconstruct malicious activity and attack sequences using available network traffic and security evidence.
• Support timely identification, reporting, and response to cyberattacks, network intrusions, and unauthorized activity.

Network Traffic and Packet-Level Analysis

• Conduct detailed packet-level analysis to investigate suspicious network communications and validate security alerts.
• Use network protocol analyzers and packet inspection tools to identify malicious traffic and abnormal network behavior.
• Validate intrusion detection system (IDS) alerts against captured network traffic.
• Analyze network protocols, communication patterns, and traffic characteristics to identify potential exploitation attempts.
• Identify applications and operating systems based on observed network traffic characteristics.
• Examine network activity to identify indicators of reconnaissance, exploitation, lateral movement, and other potentially malicious behavior.
• Apply network forensic techniques to support incident investigation and cyber defense analysis.

Intrusion Detection and Signature Analysis

• Analyze and interpret intrusion detection signatures to identify known threats and suspicious network activity.
• Support development, testing, and deployment of network security detection signatures.
• Use intrusion detection technologies, including Snort or comparable platforms, to identify host-based and network-based threats.
• Assist with the development of new detection signatures in response to emerging threats and observed malicious activity.
• Evaluate detection results to improve threat identification and reduce unnecessary alerts.
• Coordinate with cybersecurity engineering and operations teams to implement updated detection capabilities.

Cyber Defense Reporting and Collaboration

• Conduct cyber defense trend analysis to identify recurring security events, emerging attack patterns, and potential areas of concern.
• Prepare daily summaries of relevant network events, security alerts, and cybersecurity activity.
• Document investigative findings and communicate technical results to cybersecurity leadership and operational stakeholders.
• Coordinate with incident responders, network engineers, and enterprise security personnel to support investigations.
• Maintain accurate records of security events, incident escalation activities, and analytical conclusions.
• Contribute to continuous improvement of cyber defense monitoring, incident detection, and operational response procedures.

Required Qualifications
Security and Eligibility

• U.S. Citizenship is required.
• Active Top Secret / Sensitive Compartmented Information (TS/SCI) security clearance is required.
• Must be able to obtain DHS Suitability.

Professional Experience

• Minimum 2 years of directly relevant experience conducting cyber defense analysis using industry-standard cybersecurity tools and technologies.
• Demonstrated experience detecting and investigating host-based and network-based intrusions.
• Experience developing and deploying cybersecurity detection signatures.
• Practical experience applying incident handling methodologies and supporting security investigations.
• Experience collecting, correlating, and analyzing information from multiple cybersecurity data sources.
• Experience conducting network traffic analysis, packet inspection, and cyber defense trend analysis.

Technical Expertise

• Hands-on experience with intrusion detection technologies, including Snort or comparable IDS solutions.
• Ability to read, interpret, and analyze intrusion detection signatures.
• Experience using network protocol analyzers and packet inspection tools.
• Strong understanding of network communications, common protocols, and suspicious traffic patterns.
• Ability to conduct packet-level investigations to identify potential malicious activity.
• Experience analyzing cybersecurity alerts and distinguishing legitimate network activity from potential threats.
• Knowledge of cyber incident identification, documentation, escalation, and response procedures.
• Ability to correlate network events and security information from multiple monitoring technologies.
• Experience identifying network anomalies, reconnaissance activity, and indicators of potential compromise.
• Strong analytical, troubleshooting, technical documentation, and communication skills.

Preferred Qualifications

Candidates with the following experience and technical capabilities are especially encouraged to apply:

Cybersecurity Analysis and Automation

• Python programming or scripting experience supporting cybersecurity analysis and automation.
• Experience with the Carnegie Mellon SiLK network traffic analysis tool suite.
• Strong mathematical, scientific, or analytical problem-solving background.

Network Security and Defensive Operations

• Experience supporting enterprise cybersecurity monitoring and incident response operations.
• Familiarity with security information and event management (SIEM) technologies, including ArcSight or comparable solutions.
• Experience working with network traffic metadata, security event correlation, and intrusion detection technologies.
• Familiarity with network forensic analysis and investigation of suspicious communications.

Education Requirements

Candidates must meet one of the following education and experience requirements:

Option 1 - Bachelor's Degree

Bachelor of Science degree in Computer Science, Cybersecurity, Computer Engineering, or a related technical discipline.

Option 2 - Equivalent Experience

High school diploma and a minimum of 4 years of network investigations experience.
Desired Professional Certifications

One or more of the following certifications or relevant training credentials is preferred:

• GIAC Network Forensic Analyst (GNFA)
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Security Essentials (GSEC)
• CompTIA Advanced Security Practitioner (CASP+), now SecurityX
• CompTIA Cybersecurity Analyst (CySA+)
• CompTIA Network+
• CompTIA Security+
• Palo Alto Networks-related training or certification (PaLMS)
• Federal Virtual Training Environment (FedVTE) training
• SANS SEC401 training
• ArcSight or comparable SIEM technology certifications

Apply Today

If you are a cybersecurity professional with experience in network defense, intrusion detection, packet-level analysis, and incident response, we encourage you to explore this opportunity with Argo Cyber Systems.

Join a mission-focused team dedicated to identifying cyber threats, investigating malicious activity, and strengthening the cybersecurity defenses of the U.S. Government.

Position: Cyber Network Defense Analyst (CNDA) - Level II
Company: Argo Cyber Systems, LLC
Security Clearance: Active TS/SCI Required
Citizenship: U.S. Citizenship Required
Suitability: Must be able to obtain DHS Suitability