The Tier 3 Cyber Threat Intelligence Analyst joins the Network Operations Security Operations team to support the Department of Homeland Security enterprise. This role involves identifying, tracking, and investigating high-priority threat campaigns and malicious actors by analyzing TTPs to enhance the organization's security posture. The analyst will develop cyber threat intelligence reports, conduct research into infrastructure using frameworks like MITRE ATT&CK and the Diamond Model, and perform host-based and network-based forensics for incident response and threat hunting. Key technical requirements include proficiency with Splunk, Analyst1, CrowdStrike Falcon, Tanium, Proofpoint TAP, and Zscaler. The role requires skills in Python, Bash, Visual Basic, or PowerShell to develop detection scripts. Candidates must possess a Top Secret/SCI clearance and demonstrate expertise in malware analysis, signature development, and correlating intelligence data from various sources to establish countermeasures.
Identify and investigate high-priority threat campaigns, malicious actors, and their associated TTPs.
Analyze the cyber threat landscape to enhance the organization's IT operating environment security posture.
Develop and deliver Cyber Threat Intelligence reports to provide situational awareness for peers and customers.
Support the Network Operations Security Center during incident response and proactive threat hunting activities.
Correlate various intelligence sources to collect indicators, identify shifts in TTPs, and establish countermeasures.
Perform host-based and network-based forensics to identify advanced threats and develop security content like signatures.
Enrich data from intelligence sources with internal logs and alerts to drive detection initiatives.
Develop scripts in languages like Python or PowerShell to support cyber threat detection and reporting.
What we're looking for
Must possess a Top Secret/SCI clearance.
Bachelor's degree in an IT field and 8-12 years of experience, or a Master's degree in an IT field and 8+ years of experience.
Minimum of 7 years of experience as a Tier III senior cyber security analyst performing intelligence analysis, collection management, and technical analysis.
Two years of recent experience with host-based and network-based security monitoring solutions including security content recommendation or development.
Must hold at least one of the following certifications: CASP+ CE, CCNP-Security, CISA, CISP (or Associate), GCED, GCIH, or CCSP.
Deep understanding of the Pyramid of Pain, Cyber Kill Chain, MITRE ATT&CK, and the Diamond Model.
Ability to correlate and enrich data from intelligence sources with internal logs and incident data from Splunk and Analyst1.
Proficiency in Python, Bash, Visual Basic, or PowerShell (preferred); experience with CrowdStrike Falcon, Tanium, Proofpoint TAP, and Zscaler (preferred).