Defensive Counter Cyber - DCC
Lackland Air Force Base, San Antonio, TX, USA
Req #6384
Tuesday, April 9, 2024
STS Systems Support, LLC (SSS) is seeking a Defensive Counter Cyber - DCC – Senior
Requirements:
- DoDD 8570.01‐M/8140.01 I AT Level III CND
- Active TS/SCI
- More than 5 years of experience with extensive knowledge of operating systems fundamentals. BA/BS or MA/MS
- More than five (5) years of experience with extensive knowledge of Operating systems fundamentals (Windows and/or Unix/Linux), System administration (Windows and/or Unix/Linux), Network traffic analysis, Penetration testing, Network security, Incident response & Incident response handling, Computer and network forensics, Vulnerability and malware analysis.
- Extensive knowledge of network firewalls, computer and server log analysis, computer network servers (DNS, proxy, e‐mail, domain controller, file server, Active Directory) and analysis of their logs
- Extensive knowledge of digital evidence collection, handling and security
- Experience with computer incident response and analysis and report dissemination
- Extensive knowledge and experience with network packet capture and analysis software such as WireShark (Ethereal) and Snort
- Experience with standard DoD network topology and DMZ boundary protection
- Experience with system analysis software (i.e. EnCase/EnCase Enterprise or FTK), software coding and debugging, and the virtual machine (VM) environment.
- Expert knowledge of MITRE ATT&CK framework, and its uses within the cybersecurity community (e.g., Open Source projects)
Duties:
- Perform threat hunting for suspicious activity based on anomalous activity and indicators of compromise from various intelligence sources and toolsets.
- Comply with 3rd party MOU/MOA monitoring and reporting requirements. (CDRL A002)
- Identify intrusions and vulnerabilities and recommend mitigation strategies and techniques to secure networks.
- Identify, analyze and develop defensive counter cyber measures to thwart advanced persistent threats and intrusions of AF networks, domains and enclaves.
- Conduct and support Defensive Counter Cyber Operations to interactively search for Advanced Persistent Threats (APT) and Indicators of Compromise (IOC) using enhanced data collection and analysis methods.
- Provide incident response impact assessments.
- Produce network security posture assessments. (CDRL A008)
- Analyze systems for suspicious activities related to the DCO mission
- Determine exploitation methods and attack vectors.
- Provide OJT to other contractor employees, military, and/or civilian personnel, and ensure continuity folders/working aids are updated at least once per quarter in order to ensure efficient transition when personnel rotate.
- Create and document metrics for reporting and analysis to improve weapon system processes, procedures, and mission execution. (CDRL A009)
- Maintain currency on latest industry trends and provide operational reports/assessments for development of tactics, techniques, and procedures. (CDRL A002)
- Provide requested information to operational flight commander as it relates to the Incident Response processes and procedures.
- Utilize the Mitre ATT&CK Matrix in performance of duties.
- Plan hypothesis‐based threat hunt missions. Utilize current Cyber Threat Intel team provided information in threat prioritization/hunt creation.
- Execute hunt mission within specified cyber terrain.
- Coordinate with ESM and Content Development to automate threat hunts and/or develop standing detections for threat hunts.
- Request Tactical Validation and Assessment (TVA) to validate hunt techniques and/or created alerting mechanisms.
- Identify and report coverage gaps in detection and weapon system visibility/capability.
- Develop hypothesized schemes‐of‐maneuver of adversary behavior as needed for hunt missions in coordination with Cyber Threat Intel team.
- Leverage the MITRE ATT&CK matrix to map adversarial TTPs to current security coverage within specified cyber terrain.
- Develop threat hunts for emerging cyber threats, to include 0‐day proof‐of‐concepts, CVE exploitation, and adversary TTPs.
- Organize and analyze collected data to determine trends, perform long‐tail and frequency analysis of host and network artifacts, and baseline enterprise activity.
Other details
- Pay Type Salary
- Lackland Air Force Base, San Antonio, TX, USA