Splunk Cyber Threat Analyst
This position is for a Cyber Threat Analyst for an organization that specializes in analyzing and producing advanced cybersecurity and threat intelligence.
Responsibilities include identifying and assessing threats and potential threats to the customer's personnel, information, and information systems.
The role involves providing timely and relevant intelligence to assist in mitigating cyber threats, supporting the evaluation, implementation, and operation of advanced analysis tools and technologies, and developing and supporting the Cyber Insider Threat Program.
The company is located in the Washington . Metro area and will remain 100% remote, but the candidate must be local to the area.
What You Will Be Doing :
- Support the customer's comprehensive cyber threat analysis efforts.
- Serve as the liaison between the Splunk Engineering team and SOC operations teams to configure the Splunk Data Lake for optimal SOC functionality.
- Create executive-level dashboards summarizing cyber status or risk level per Splunk, based on criteria published by FISMA and other Government organizations.
- Produce metrics and trendlines for threat activity and provide in-product security research on existing and emerging threats.
- Support the use of machine learning for event correlation and proactive cyber response capabilities.
- Research, analyze, and draft documents such as use case requirements, system change documents, and process documents / workflows.
- Ensure documentation is accurate, complete, and adheres to quality, editorial, and government standards.
- Develop content including presentations, bulletins, white papers, memos, policies, briefings, and other products appropriate for the intended audience.
- Collaborate with analysts and engineers to acquire subject knowledge.
- Assist in coordinating projects from the planning stage, provide additional or missing materials, and edit for content format, flow, and integrity.
- Perform Cyber Threat Assessment and Remediation Analysis within the context of SIEM configuration requirements.
- Process, organize, and analyze incident indicators retrieved from the client environment and correlate these indicators with various intelligence data.
- Coordinate with internal teams and assist in the creation of engagement deliverables for activities such as Insider Threats, Rule of Engagement (ROE), Threat Hunting, After Action Reports, and other artifacts supporting testing, monitoring, and protecting the enterprise.
- Investigate network and host detection and monitoring systems to advise on engagement processes.
- Develop core threat intelligence capabilities and subject matter expertise.
- Develop and execute bash and python scripts to process discrete log files, extract specific incident indicators, and develop tools to aid in Tier 1 and Tier 2 functions.
Required Skills & Experience :
- Bachelor’s degree in Computer Science, Information Systems, Mathematics, Engineering, or a related field, or an additional two (2) years of relevant experience.
- Experience in cyber threat intelligence or intelligence analysis.
- Cybersecurity certifications preferred but not required.
- Strong organizational, verbal, presentation, and written communication skills. Comfortable presenting briefings to clients.
- Proficient in using Splunk for SOC operations support.
- Skilled in assessing SIEM data for search and visualization capabilities.
- Demonstrated proficiency in Incident Response Process, SOC operations, and threat hunting.
- Good understanding of system log information and data collection for Incident Events.
- Operational knowledge of enterprise networking and security tools (firewalls, Antivirus, HIDS, IDS / IPS, proxy, WAF) and Windows and Unix / Linux systems.
- Experienced in log analysis and reporting.
- Skilled in creating and tracking investigations to resolution.
- Experience with Endpoint security solutions such as Windows Defender, Tanium, FireEye Solutions, Antivirus Solutions, and EDR Tools.
- Understanding of compliance or regulatory frameworks (., FISMA, NIST, ISO).
- Solid understanding of application, authentication, network security principles, and operating system hardening techniques.
- General knowledge of cyber-attack frameworks (MITRE ATT&CK, Lockheed Cyber Kill Chain).
- Understanding of Computer Network Defense (CND) policies, procedures, and regulations.
- Experienced in SIEM monitoring and analysis, network traffic analysis, log analysis, and differentiating between potential intrusion attempts and false alarms.
Applicants must be currently authorized to work in the United States on a full-time basis now and in the future.
This position doesn’t provide sponsorship.
Cyber Threat Hunt Analyst - Security Clearance Required
Proactively conduct threat hunting activities to detect advanced threats that evade traditional security solutions and continuously monitor and analyze threat intelligence sources to stay informed about emerging threats. The ideal candidate will have a deep understanding of cyber threat hunting, adv...
Insider Threat Analyst - Cyber Intel
Insider Threat Analysts conduct threat analysis, provide assessments of threats and vulnerabilities, produce investigative leads, uncover policy violations, assess risk posed by trusted insiders, oversee the data collection effort on NGA's networks using UAM tools, and manage & develop approved ...
Cyber Investigator [ insider threat, data loss prevention, digital forensics ] - Senior Analyst
Cyber Investigator [ insider threat, data loss prevention, digital forensics ] - Senior Analyst. The Cyber Investigator provides expert-level contributions to AIG's Information Security Office by protecting the company's critical assets from internal threats and reducing overall risk. This senior le...
Splunk Cyber Threat Analyst
My client a small cyber consulting firm is seeking a Splunk Cyber Threat Analyst to join their growing team. The position is a fully remote (Must be local to the DMV area) 6 month contract-to-hire (100% guaranteed conversion). You will support the customer’s overall cyber threat analysis efforts. Ge...
Cyber Threat Analyst/ Incident Manager
Cyber Threat Analyst / Incident Manager. Applying knowledge of the tactics, techniques, and procedures of various criminal, insider, hacktivist, and nation-state threat actors to identify and validate threats. Government customer to provide support for onsite incident response to civilian Government...
Cyber Risk Analyst - Remote
We are actively hiring for a Cyber Risk Analyst - Remote! Join us and support CSAA IG in achieving our goals. Works with the security team, including vulnerability management, logging and monitoring, and threat intelligence teams to understand threats and the CSAA IT environment to communicate CSAA’...
Insider Threat Analyst - Cyber Intel
Insider Threat Analysts conduct threat analysis, provide assessments of threats and vulnerabilities, produce investigative leads, uncover policy violations, assess risk posed by trusted insiders, oversee the data collection effort on NGA’s networks using UAM tools, and manage & develop approved data...
Industrial Control System Cyber Threat Intelligence Analyst
Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. ...
GIS Analyst (Remote in Washington, DC)
Must be able to demonstrate GIS mapping and analysis skills including, but not limited to cartographic techniques, geoprocessing ToolBox familiarity (3D Analyst Tools, Spatial Analyst Tools, Data Management Tools,. The GIS Analyst will join the National Geospatial Practice team in our Infrastructure...
Cyber Threat Analyst
Applying knowledge of the tactics, techniques, and procedures of various criminal, insider, hacktivist, and nation-state threat actors to identify and validate threats. Government customer to provide support for onsite incident response to civilian Government agencies and critical asset owners who e...