Cyber Security Analyst

• Facilitate and implement Splunk infrastructure to ingest, analyze and visualize machine generated data and deploy, configure and maintain Splunk Enterprise components such as indexers, Search Heads and Forwarders.

• Create dashboards, alerts and reports for threat detection.

• Patch and maintain servers continuously to meet security compliance standards.

• Ensure that the Red Hat Enterprise Linux servers are operational and reporting properly.

• Administer and manage the organization’s security posture via deployment of security policies (Microsoft Intune), threat monitoring & response (Microsoft Defender/Sentinel), data governance-Data Loss Prevention (Microsoft Purview), configuring log analytics-develop detection rules & playbooks (Microsoft Sentinel) and ensure compliance.

• Troubleshooting application and server issues and responding to federal customer service requests.

• Utilizes software and hardware tools and identifies and diagnoses complex problems and factors affecting performance. 

• Support incident response efforts by identifying vulnerabilities related to emerging threats and zero-day exploits.

• Interfaces with PMO and vendor support service groups to support Cyberspace Task Order efforts and ensure proper escalation during outages or periods of degraded system performance. 

• Create/Update documentation needed to support the Splunk team requirements, taskings, deliverables, and maintenance of the tool.

• Engage in weekly Splunk engineering meetings in support of the agency’s mitigation, compliance, assessment efforts and initiatives.

• Monitor and track vulnerabilities, End-of-Life and priority action items.

• Design, build, and implement network systems. 

• Perform cyber investigations and analysis.

• Research and analyze a variety of commodity and APT based malware and techniques.

• Search our existing infrastructure for signs of malware and malicious events not detected by our existing security controls.

• Administer Assured Compliance Assessment Solution (ACAS) system comprised of Security Center, Nessus Scanner and the Nessus Network Monitor.

• Administer Trellix ESS, including ePolicy Orchestrator (ePO), Solidcore, and DLP.

• The ability to work independently as well as collectively within a team, apply critical thinking techniques, and effectively communicate with federal customers and other team members, both orally and in writing.

• Demonstrated experience working with complex system implementations and organizational processes to include maintaining system documentation.

• Strong understanding, proficiency and experience with Linux and ability to effectively manage, secure and troubleshoot Linux-based environments.

• CompTIA Linux+ or Linux Professional Institute (LPIC-1/LPIC-2) certification or Red Hat Certified System Administrator

• Familiarity with Splunk, Elastic Stack (ELK) or similar.

• Active CompTIA Security+ certification

Preferred but not required:

• Splunk Enterprise Certified Administrator or Splunk Enterprise Certified Architect
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Microsoft Certified: Cybersecurity Architect (SC-100)
• Microsoft Certified: Azure Fundamentals (AZ-900)
• CompTIA CySA+

Minimum Education Required: 

• BS/BA degree in Computer Science, Management Information Systems, or related IT discipline.
• ALLOWABLE SUBSTITUTION:  An additional four (4) years of experience can be substituted for a BS or BA degree. 
• Ability to pass a high-level background investigation