Job Type
Full-time
Description
* This position is contingent upon a future opening with Gunnison.
Salary: $130,000 - $145,000/year
Work location: Hybrid, 2-3 days per week on-site in Bethesda, MD.
- Support cybersecurity incident detection, analysis, response, containment, recovery, and post-incident activities across NIH CIT enterprise network, web application, endpoint, server, and cloud environments.
- Monitor, investigate, validate, and triage security events, alerts, suspicious activity, and potential indicators of compromise; assign appropriate severity and criticality based on operational impact, threat context, and established escalation procedures.
- Apply the enterprise incident-response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident analysis.
- Analyze network traffic, system logs, endpoint telemetry, application activity, authentication events, and security-tool alerts to identify malicious, anomalous, or unauthorized activity.
- Evaluate network, web application, cloud, and endpoint environments for insecure configurations, vulnerable ports, unnecessary services, weak protocols, default credentials, insecure communication methods, and other security weaknesses.
- Perform cybersecurity incident analysis using tools and platforms such as FireEye or comparable endpoint/threat-detection technologies, Palo Alto IDS/IPS and firewall technologies, Splunk SIEM, Tenable vulnerability-management tools, and related security operations tools.
- Support investigation of web application and cloud security events, including suspicious access, misconfigurations, exposed services, anomalous traffic, unauthorized changes, and potential data-security risks.
- Maintain a working knowledge of common ports, protocols, network services, attack vectors, and security-control configurations relevant to incident investigation and response.
- Conduct or support incident containment and recovery activities in coordination with system owners, network engineers, cybersecurity engineers, application teams, and Government stakeholders.
- Create, update, and follow incident response playbooks, standard operating procedures, RACI charts, escalation matrices, and communication plans.
- Document incident timelines, investigative steps, evidence, findings, impact analysis, containment actions, recovery actions, and recommended corrective measures.
- Lead or support post-incident reviews and lessons-learned activities; assess the effectiveness of the Incident Response Plan (IRP), playbooks, and procedures, and recommend improvements.
- Assist with annual incident-response exercises, tabletop exercises, and technical tests; document test results, gaps, corrective actions, and updates to incident-response documentation.
- Produce accurate, timely incident reports, status updates, dashboards, executive summaries, and management briefings appropriate for technical and nontechnical stakeholders.
- Maintain familiarity with NIST SP 800-61 incident-handling guidance and apply it to daily incident-response operations.
Requirements
Minimum of two (2) to five (5) years of progressively responsible experience in cybersecurity incident response, security operations, network security, application security, cloud security, threat detection, or a related discipline.
Candidates should demonstrate experience in:
- Security-event monitoring, alert triage, incident investigation, incident documentation, escalation, and response coordination.
- Enterprise incident-response processes, including preparation, detection and analysis, containment, eradication, recovery, and post-incident activities.
- Network security, web application security, cloud technologies, endpoint security, and security monitoring.
- Identifying vulnerable services, insecure ports and protocols, default or weak configurations, and common network/application security weaknesses.
- SIEM analysis, preferably Splunk, including log searches, dashboards, correlation, alert analysis, and report generation.
- IDS/IPS, firewalls, endpoint detection and response, vulnerability-management, and threat-detection technologies, including Palo Alto, FireEye or comparable platforms, and Tenable.
- Windows and Linux operating systems, including basic system/log analysis and security troubleshooting.
- NIST SP 800-61 and the creation or use of incident-response playbooks, RACI charts, escalation procedures, SOPs, and lessons-learned documentation.
- Preparing technical findings, incident reports, management updates, and executive-level summaries.
- Bachelor's degree from an accredited college or university in cybersecurity, information assurance, computer science, information systems, computer engineering, network engineering, digital forensics, systems engineering, or a closely related technical discipline.
- EC-Council Certified Incident Handler (E|CIH), current and active
- Offensive Security Certified Professional (OSCP), current and active
- GIAC Certified Incident Handler (GCIH), current and active
- Current Splunk certification, such as Splunk Core Certified Power User, Splunk Enterprise Certified Admin, Splunk Core Certified Advanced Power User, or an equivalent Splunk security/engineering credential
Clearance Requirement: Ability to obtain and maintain a Public Trust.
Desired Qualifications:- Master's degree in cybersecurity, information assurance, computer science, digital forensics, information systems, engineering, data analytics, or a related technical discipline.
- GIAC Certified Intrusion Analyst (GCIA)
- GIAC Security Essentials (GSEC)
- GIAC Certified Forensic Analyst (GCFA)
- GIAC Reverse Engineering Malware (GREM)
- GIAC Penetration Tester (GPEN)
- CompTIA Security+, CySA+, PenTest+, or CASP+
- Certified Ethical Hacker (CEH)
- Certified Information Systems Security Professional (CISSP)
- Palo Alto Networks Certified Network Security Engineer (PCNSE) or related Palo Alto credential
- Tenable/Nessus platform training or certification
- FireEye, Trellix, Microsoft Defender, CrowdStrike, SentinelOne, or comparable EDR/XDR training
- AWS Certified Security - Specialty
- Microsoft Certified: Azure Security Engineer Associate
- Google Professional Cloud Security Engineer
- Cisco CyberOps Associate/Professional, CCNP Security, or equivalent network-security certification
- ITIL Foundation, particularly for candidates supporting formal incident, problem, and change-management processes
The salary range for this position depends upon multiple factors including location, the individual's knowledge, skills, competencies, and experience, and contract-specific budget constraints and organizational requirements.
Gunnison Consulting Group's total compensation package also includes bonus and profit-sharing opportunities, depending on company and employee performance. Available employee benefits include:
- 3 weeks of Personal Leave your first year
- 11 paid Holidays each year
- 5 days of Flexible Time Off each year for approved training or certifications (self-study is ineligible)
- 401(k) company match at 50% up to 10% of your salary
- Medical, Dental and Vision Insurance
- Life and Disability Insurance
- Public Transportation Subsidies
- Certifications and Training Allowance - Up to $5,000/year!
Salary Description
$130,000 - $145,000/year
