Position Summary

The Cyber Analyst team member is responsible for the analysis of all technology devices which will include Operational Technology (OT) and Industrial Control Systems (ICS) with-in enterprise. This includes analytical analysis of device communication, forensic analysis of Windows or Linux systems and servers, timeline analysis of activity on these endpoints, user permission and authentication audits, log analysis, and malware identification/triage. As journeyman the role may also encompasses the development and engineering of legacy, current, or emerging solutions.
An ideal candidate for this position will be a proactive worker who has experience not only with system or network administration, but also with the nuances of OT, ICS and Building Automation Services (BAS). Proficiency in Windows and Linux operating systems (OS) mechanics and filesystem structures, disk and memory forensics, and commonly abused tools/vectors for persistence, privilege escalation, and lateral movement are crucial. In the context of OT and ICS, understanding operating system log analysis and triaging suspicious file artifacts for unusual behavior with a good understanding on how controls systems manage and operate infrastructure supporting functions like water, power, energy, manufacturing, and other critical services.

• The selected candidate will have several responsibilities from day to day drawn from a wide array of activities and experience working in the following areas:
• Validating and verifying system security requirements and establishing system security designs for systems, major system elements, and interfacing systems that are part of a network environment with geographically distributed components.
• Identifying and implementing appropriate information security architectures and functionality to ensure uniform application of security policy and enterprise solutions.
• Recommending and developing technical solutions, products, and standards based on current and desired system security architecture.
• Communicating with Program Managers and POCs from customer organizations when necessary, regarding Security issues of significant importance.
• Analyzing and assessing system implementation against multiple security compliance policies and recommending and implementing enhancements
• Administration of multiple systems of different architectures (Windows, Linux, Mac, etc)
• Supporting risk assessment, risk management, security control assessment, continuous monitoring, service design, and other Information Assurance (IA) program support functions.

• Must have an active Secret Clearance to be considered
• Bachelor's Degree in IT/Cybersecurity related field
• At least 3 years, (Junior level) applicable 1 to 2 years of experience in security operations or industrial control automation/management and demonstrating analytical duties and preforming host or network security analysis
• Support SOC team in operating and preforming duties in a Security Operations Center (SOC) to provide a secure environment that facilitates incident response and threat hunting activities.
• Build and create a test bed of Operational Technology (OT) Industrial Control Systems (ICS)
• Engineer future solutions, network enhancements, and system infrastructures
• Manage the SIEM platform to monitor for security alerts and coordinate vulnerability assessments and artifact collection across servers and network devices
• Evaluate network structures and device configurations for security risks, offering recommendations based on best practices, and gather data to identify and respond to network intrusions
• Analyze network traffic and system logs to identify malicious activities, vulnerabilities exploited, and methods used, and develop processes to enhance SOC response and efficiency
• Conduct comprehensive technical analyses of computer evidence, research and integrate new security tools into the SOC, and synthesize findings into reports for both technical and non-technical audiences

• Knowledge of Operational Technology (OT) or Industrial Control Systems (ICS) are a plus
• Strong analytical and troubleshooting skills
• Able to provide expert content development in Splunk Enterprise Security using tstats and data models
• Understands how to utilize knowledge of latest threats and attack vectors to develop correlation rules for continuous monitoring on various security appliances
• Experience in other tools and communication languages as applicable such as Nessus, Endgame, CrowdStrike, Gray Noise, Shodan, Bacnet, MODBus, SCADA systems, and PCAP
• Review logs to determine if relevant data is present to accelerate against data models to work with existing use cases
• Certified Ethical Hacker (CEH), GIAC Certified Incident Handler (GCIH), or relevant IT technology certification
• Examples of other certifications include:
• CERT Certified Computer Security Incident Handler,
• ECC CEH (Electronic Commerce Council Certified Ethical Hacker)
• GCIH (GIAC Certified Incident Handler)
• GISF (GIAC Information Security Fundamentals)
• CISSP (Certified Information System Security Professional)
• Additional certifications at an equivalent may also be considered.