Tier 3 DCO Senior Analyst / Threat Hunter

Required Responsibilities:

• Lead incident response efforts, including analysis, mitigation, and reporting of significant incidents per CJCSM 6510.01B.
• Manage incident response campaigns by developing strategies, coordinating multi-team efforts, and ensuring comprehensive resolution and reporting.
• Conduct proactive threat hunting to identify advanced threats and network vulnerabilities.
• Lead purple team exercises in collaboration with red and blue teams to evaluate and enhance detection and response capabilities.
• Evaluate and refine detection mechanisms, including IDS/IPS signatures and log correlation rules, to improve accuracy and reduce false positives.
• Perform advanced network and host-based digital forensics on Windows and other operating systems to support investigations.
• Coordinate with reporting agencies and subscriber sites for comprehensive incident analysis and reporting.
• Develop and maintain internal SOP documentation, ensuring alignment with CJCSM 6510.01B and applicable directives.
• Work with a team to provide 24/7 support for incident response, including non-core hours, and mentor junior analysts.
• Participate in program reviews, product evaluations, and onsite certification assessments.
• Work four 10-hour shifts (Sunday-Wednesday or Wednesday Saturday); shift placement at management’s discretion.
• Surge support may be required to support incident response actions.
• Up to 10% travel may be required, to include OCONUS locations.

Required Experience:

• 5 years of experience supporting CSSP, or similar SOC technical role.
• Comprehensive knowledge of CJCSM 6510.01B and incident response procedures.
• In depth expertise with IDS/IPS solutions, including signature development and optimization.
• Extensive experience performing digital forensics across multiple operating systems.

Certifications Required:  DoD  8570 IAT Level II certification and CSSP/CND certification required.

Security Clearance Required:  DoD Secret NOTE: Only those with this clearance will be considered.

Education Level Required:  Bachelor’s Degree in Cybersecurity, Computer, Electrical, or Electronics Engineering, or Mathematics with a concentration in computer science or equivalent.