Description

The U.S. Department of Homeland Security (DHS), Customs and Border Protection (CBP) Security Operations Center (SOC) is a U.S. Government program responsible to prevent, identify, contain and eradicate cyber threats to CBP networks through monitoring, intrusion detection and protective security services to CBP information systems including local area networks/wide area networks (LAN/WAN), commercial Internet connection, public facing websites, wireless, mobile/cellular, various cloud environments, security devices, servers and workstations. The CBP SOC is responsible for the overall security of CBP Enterprise-wide information systems, and collects, investigates, and reports any suspected and confirmed security violations.

• Create Threat Models to better understand the DHS IT Enterprise, identify defensive gaps, and prioritize mitigations
• Author, update, and maintain SOPs, playbooks, work instructions
• Utilize Threat Intelligence and Threat Models to create threat hypotheses
• Plan and scope Threat Hunt Missions to verify threat hypotheses
• Proactively and iteratively search through systems and networks to detect advanced threats
• Analyze host, network, and application logs in addition to malware and code
• Prepare and report risk analysis and threat findings to appropriate stakeholders
• Lead cyber threat hunt missions with minimal supervision or guidance and recommend courses of action, best practices, and mitigating actions to improve security practices.
• Established ability to write clearly and concisely regarding technical and non-technical products based on threat hunt findings and outcomes.
• Experience briefing senior level leaders and executives on technical topics with emphasis on the ability to translate into non-technical terms for decision makers.
• Will be responsible for developing scripts to support cyber threat detection that outputs results in a variety of formats, such as VB scripts, Python, C++, HTML, XML or other type most appropriate for the task.
• Will conduct cyber threat analysis, identifying mitigation and/or remediation courses of action; developing actionable intelligence used to protect organizational IT assets; and trending cyber threat metrics for leadership situational awareness.
• Responsible for maintaining a comprehensive understanding of the cyber threat landscape, including identifying and analyzing cyber threats actors and/or activities to enhance cybersecurity posture of an the organization's IT operating environment.
• Create, recommend, and assist with development of new security content as the result of hunt missions to include signatures, alerts, workflows, and automation.
• Coordinate with different teams to improve threat detection, response, and improve overall security posture of the Enterprise
• Identify, track and investigate high priority threat campaigns, malicious actors with the interest, capability and TTPs (Techniques, Tactics and Procedures).
• Bring a comprehensive understanding, analyzing and tracking the cyber threat landscape, including identifying and analyzing cyber threats actors, APT TTPs and/or activities to enhance cybersecurity posture of an the organization's IT operating environment.

• In-depth technical analysis on host based, network based, cloud focused, and mobile systems to identify advanced threats that evade traditional detection systems and signatures.
• Comprehension of complex IT environments with multiple stakeholders and technologies, and undersanding of escalation paths when necessary.
• Maintain the daily battle rhythm and schedule of threat hunts with emphasis on attention to detail and technical analysis.
• Review current and emerging cyber threat intelligence to maintain situational awareness and initiate threat hunts accordingly.
• Create daily, weekly and monthly reporting data.
• Collect, aggregate and report on metrics derived from threat hunts, with a regular cadence and attention to detail.

• 5+ years recent experience with host-based and network-based security monitoring using cybersecurity capabilities.
• Must be experienced developing scripts to support cyber threat detection that outputs results in a variety of formats, such as VB scripts, Python, C++, HTML, XML or other.
• Ability to work independently with minimal direction; self-starter/self-motivated.

• Certified Information System Security Professional (CISSP).
• SANS - GCIA - Intrusion Analyst
• SANS - GREM - Reverse Engineering Malware
• SANS - GISF - Security Fundamentals
• SANS - GXPN - Exploit Researcher and Advanced Penetration Tester
• SANS - GMON - Continuous Monitoring Certification • OSCP (Certified Professional)
• OSCE (Certified Expert) • OSWP (Wireless Professional)
• OSEE (Exploitation Expert) • CCSP - Certified Cloud Security Professional
• LPT - Licensed Penetration Tester • ECSA - EC-Council Certified Security Analyst
• Cyber Analyst Couse

• A minimum of five (5) years of hands-on experience with experience in the last two (2) years that includes host-based and network-based security monitoring using cybersecurity capabilities.
• Understanding of complex Enterprise networks to include routing, switching, firewalls, proxies, load balancers
• Demonstrated in-depth experience planning and executing threat hunt missions.
• In-depth knowledge of common (HTTP, DNS, SMB, etc.) networking protocols
• Expertise in network and host-based analysis and investigation.
• Previous DOD, IC or Law Enforcement Intelligence or Counterintelligence Training/Experience
• Knowledge of Structured Analytic Techniques
• Advanced Degree in Cyber Security or related field.
• Familiar with operation of both Windows and Linux based systems
• Proficient with scripting languages such as Python or PowerShell
• Familiarity with Splunk Search Processing Language (SPL) and/or Elastic Domain Specific Language (DSL)

• All Department of Homeland Security CBP SOC employees are required to favorably pass a 5-year (BI) Background Investigation
• The candidate must currently possess a Top Secret/SCI Clearance.
• In addition to clearance requirement, all CBP personnel must have a current or be able to favorably pass a 5-year background investigation (BI).