The DHS Hunt and Incident Response Team (HIRT) secures the nation's infrastructure. HIRT provides DHS's front-line response for cyber incidents and proactive hunting for malicious cyber activity. BCMC provides support for on- and offsite incident response to government agencies and critical infrastructure owners who experience cyber-attacks. BCMC delivers HIRT advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans.
We are seeking a Subject Matter Expert with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.
Responsibilities:
• Serves as a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises.
• Serves as an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities.
• Assists the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.
• Assists the Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations.
• Characterizes and analyzes network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources.
• Identifies and analyzes anomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity.
• Reconstructs malicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns.
• Examines network topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities.
• Assesses network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
• Determines appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions.
• Applies knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations.
• Applies knowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation.
• Leads analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.
• Provides expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities.
• Serves as a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents.
• Exercises considerable latitude in determining technical objectives and independently develops technical solutions to complex problems requiring ingenuity and creativity.
• Analyzes incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
• Advises technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists).
• Supports internal stakeholders on containment and eradication missions, on-site and remotely.
• Ensures evidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
• Assists with the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies.
• Distills analytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences.
• Documents analysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication.
• Assists in maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities.
Required Skills:
• U.S. Citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability.
• 10+ years of directly relevant experience
• 3+ years of experience related to the evaluation and implementation of new cyber response or network forensic capabilities.
• Hands-on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.
• Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
• Knowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments.
• Ability to:
o Characterize and analyze network traffic to identify anomalous activity and potential threats.
o Identify and analyze anomalies in network traffic using metadata (flow, DNS, proxy, etc.).
o Reconstruct malicious activity based on network traffic and device logs.
• Understanding of general attack stages (reconnaissance, initial access, lateral movement, exfiltration, etc.) and how they manifest across the network.
• Understanding of system and application security threats and vulnerabilities and how they are observed in network traffic.
• Understanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior.
• Proficiency with common operating systems (e.g., Linux/Unix, Windows).
• Experience performing cyber incident response (scoping, containment, eradication, recovery) in operational environments.
• Ability to think independently, make sound decisions under pressure, and work with limited guidance.
• Superior written and oral communication skills, including the ability to clearly explain technical issues to both technical and non-technical stakeholders.
• Ability to work collaboratively across physical locations and within distributed teams.
• Skilled in identifying different classes of attacks and attack stages and translating findings into actionable recommendations.
• Rapid Network & Tapping Setup: Ability to quickly configure network TAPs, packet brokers, SPAN ports, and unmanaged/managed switches without disrupting live production or air-gapped traffic.
Desired Skills:
• Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
• Network and system administration experience in large or complex enterprise or service-provider environments.
• Strong understanding of adversarial TTPs (including MITRE ATT&CK) and different operational threat environments (e.g., script kiddies, non-nation state adversaries, nation state actors).
• Knowledge of defense-in-depth and zero trust principles and their application to network and edge-device architectures.
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, injections, race conditions, covert channels, replay, ROP, malicious code).
• Knowledge of network device integrity verification and monitoring approaches.
• Hands-on skill in host/network intrusion detection and event correlation across multiple telemetry sources (firewalls, IDS/IPS, endpoint, SIEM).
• Experience with malicious activity analysis, including network beaconing, C2, and data exfiltration detection.
• Experience with Identity and Access Management (IAM) tools and their integration into network/edge security architectures.
• Ability to review and analyze Enterprise Architecture (EA) from a security perspective and recommend architecture-level improvements.
• Ability to collaborate with stakeholders at multiple levels within an organization (technical staff, management, senior leadership).
• Field Diagnostics & Cyber Forensics: Skills in running preloaded analysis stacks, protocol parsers (e.g., Modbus, DNP3, OPC UA), vulnerability scanning, and local packet capture at line rate.
• Compact Pack & Weight Management: Packing, securing, and transporting ruggedized cases (such as Pelican or Nanuk) that fit standard weight and carry-on/air-transport limits.
Required Education:
• BS in Computer Science, Cyber Security, Computer Engineering, or related degree;
OR HS Diploma and 22+ years of technical experience in the area of expertise.
Desired Certifications (One or more):
• IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder,CEH,
• SANS GIAC GCIA or GNFA (preferred for network forensics).
• SANS GRID, GICSP, or GCIP (plus).
• Vendor / network certifications (highly desired):
o Cisco CCNA (or higher: CCNP Security, CCNP Enterprise).
o Vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti (e.g., PCNSE, JNCIS/JNCIP, etc.).
Benefits
Extremely competitive salary
95% employer paid for employee medical, dental, & vision coverages
100% employer paid for employee life, STD & LTD disability coverages
401k with company match
Flexible Spending Account (FSA) for dependent & health care
11 standard holidays & 3 weeks of annual leave
ESS-3690
Subject Matter Expert I - SME01 - SME
