Incident Response Analyst (Incident Monitoring)
TISTA Science and Technology Corporation, a CMMI Maturity Level 3 company, focuses on delivering information technology (IT) and professional services to Federal and State agencies. TiSTA is an Inc. 500 company, a recipient of the 2010 Top 100 Service-Disabled Veteran-Owned Businesses from Diversity Business, recognized in Washington Technology’s FAST 50 list of the fastest growing small businesses in government contracting in 2012 & 2013, recognized as the Top 25 Fastest Growing Small Technology companies by the Washington Business Journal in 2014 & 2015, and selected as the Veteran Owned Company of the Year in 2014 by the Montgomery County MD Dept. of Economic Development.
As a Incident Response Analyst, you will be given the opportunity to teach a team of security analysts about both traditional and unconventional ways to detect, analyze, and mitigate potential intrusions and other security incidents. Candidates must be willing to work in a SOC environment, demonstrate strong problem solving skills, have experience in various toolsets and best practices, and able to think critically.
- Collect and analyze event information and perform threat or target analysis duties. Interprets, analyzes, and reports all events and anomalies in accordance with Computer Network Directives, including initiating, responding, and reporting discovered events.
- Manages and executes multi-level responses and addresses reported or detected incidents.
- Report to, and coordinates with external organizations and authorities.
- Coordinates and distributes directives, vulnerability, and threat advisories to identified consumers.
- Develops focused reporting and briefings for advanced cyber threats and activity
- Provides correlation and trending of Program’s cyber incident activity
- Create TTPs, AARs, and ability to do deep drive investigations on complex incidents.
- Maintains situational awareness reports for advanced threats such as Advanced Persistent Threat (APT) and Focused Operations (FO) incidents.
- Author Standard Operating Procedures (SOPs) and training documentation.
- Background in hands on computer and networking experience to include an understanding of TCP/IP, routing, and major Internet protocols.
- 5+ years Intrusion monitoring, Incident response and mitigation, web application security, threat research or intelligence analysis.
- Ability to read and write scripts in various languages. (php, ksh, powershell, SQL, and similar)
- 5+ years Snort, Sourcefire, BASE, or similar IDS experience.
- 5+ years using QRADAR or ArcSIght, Splunk, and/or similar SEIM experience.
- Candidates must be willing to work in an on-call situation as well as needed per rotation.
- Excellent written and oral communication skills.
- Self-motivated and able to work in an independent manner.
- Experience and proficiency in a various toolsets and best practices.
- Bachelor's Degree in a technical discipline with a minimum of 5 years related technical experience is required for a level 3 role. An additional 2 years of experience may be substituted in lieu of a degree.
- Must have at least two (2) certifications, from a respectable security organization based on DOD8570 standard.
Location: Martinsburg, WV
Equal Opportunity Statement
TISTA is an Equal Opportunity / Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, or protected veteran status.