The Tier 3 Cyber Threat Intelligence Analyst joins the team supporting the Department of Homeland Security Network Operations Security Center. This role involves identifying, tracking, and investigating high-priority threat campaigns and malicious actors to enhance the cybersecurity posture of the IT operating environment. Daily responsibilities include analyzing APT TTPs, conducting host-based and network-based forensics, and developing new cyber threat intelligence reports for situational awareness. The analyst will perform threat hunting, malware analysis, and security content development, including signatures and rules. Required skills include proficiency with the Cyber Kill Chain, MITRE ATT&CK, and the Diamond Model. Technical requirements include using Splunk, Analyst1, CrowdStrike Falcon, Tanium, Proofpoint TAP, and Zscaler. Candidates must also be able to develop scripts using Python, Bash, Visual Basic, C++, HTML, or XML.
Identify, track, and investigate high-priority threat campaigns and malicious actors' TTPs.
Analyze the cyber threat landscape to enhance the organization's IT operating environment security posture.
Develop and drive new cyber threat intelligence reports for peers, management, and customer teams.
Support the Network Operations Security Center during incident response and threat hunting activities.
Conduct trending and correlation of intelligence sources to establish countermeasures and increase cyber resiliency.
Perform host-based and network-based forensics to identify advanced cyber threat activities and malware.
Develop security content, including signatures and rules, for host-based and network-based monitoring solutions.
Correlate and enrich data from intelligence sources with internal logs and alerts using Splunk and Analyst1.
What we're looking for
Must currently possess a Top Secret/SCI Clearance.
Must have a BS in an IT related field and 8-12 years of IT experience, or an MS in an IT related field and 8+ years of IT experience.
Must have a minimum of 7 years of experience as a Tier III senior cyber security analyst performing intelligence analysis, collection management, and technical analysis.
Must have two years of recent experience with host-based and network-based security monitoring solutions and security content recommendation or development.
Must have a deep understanding of the Cyber Kill Chain, MITRE ATT&CK, the Diamond Model, and the "Pyramid of Pain".
Must have strong written and oral communication skills.
Must have one of the following certifications: CASP+ CE, CCNP-Security, CISA, CISSP (or Associate), GCED, GCIH, or CCSP.
Preferred certifications include SANS GCTI, and experience with Python, Bash, Visual Basic, or PowerShell (preferred).