Job Summary: 

• Receive, document, and report cybersecurity events.
• Categorize incidents and implement corresponding escalation procedures.
• Communicate and coordinate incident response efforts.
• Conduct daily operational update meetings for SOC staff and unscheduled situational update briefings for FAA leaders.
• Analyze reports to understand threat campaign techniques, lateral movements, and extract indicators of compromise (IOCs).
• Provide telephone, e-mail, and ticket service to customers.
• Reference applicable departmental and operating administration policies in work products.
• Access, secure, and inspect local classified information processing areas.
• Perform any other duties as requested by the Contracting Officer Representative and SOC management.

Skills on Resume: 

• Incident Detection (Hard Skills)
• Incident Categorization (Hard Skills)
• Incident Escalation (Hard Skills)
• Incident Communication (Soft Skills)
• Threat Analysis (Hard Skills)
• Customer Support (Soft Skills)
• Policy Compliance (Hard Skills)
• Classified Access (Hard Skills)

Job Summary: 

• Provide incident handling and analysis to support 24x7x365 operations.
• Manage triage, reporting, and escalation for Incident Case Management.
• Utilize ArcSight, Network Traffic Packet Analyzer, Intrusion Detection System (IDS), and other toolsets to identify and investigate anomalies.
• Maintain constant monitoring of intrusion detection systems.
• Create technically detailed reports based on intrusions and events.
• Respond to computer incident investigations.
• Coordinate with other teams on the remediation of detected incidents.
• Analyze and evaluate anomalous network and system activity.
• Recommend modifications to security tools and configurations to detect, prevent, and mitigate intrusions.
• Recommend mitigation activities and provide after-action reports on the remediation of vulnerabilities, and reduce the chance of further exploitation.
• Assist in deploying security toolsets and capabilities.

Skills on Resume: 

• Incident Handling (Hard Skills)
• Incident Analysis (Hard Skills)
• Case Management (Hard Skills)
• Anomaly Detection (Hard Skills)
• System Monitoring (Hard Skills)
• Technical Reporting (Hard Skills)
• Incident Response (Hard Skills)
• Team Coordination (Soft Skills)

Job Summary: 

• Perform complex analytics and correlation between disparate log sets to identify relationships.
• Understand malware and exploit lifecycle.
• Conduct log-mining and anomaly detection.
• Apply a comprehensive understanding of networking protocols, infrastructure, and design.
• Develop new processes for analyzing and evaluating threat activity.
• Produce intelligence products, including emerging threat advisories, weekly threat trends, and malware and malicious tool analysis.
• Monitor advanced threat detection and analysis tools to detect and validate intrusions beyond standard SOC services.
• Understand strategic vision, develop objectives, and perform tasks to meet goals.
• Apply detailed understanding of advanced tactics and methods used in Cybercrimes, Hacktivism, and APTs.
• Interpret highly technical data and perform detailed data analysis, slicing, and dicing.
• Leverage accredited training, certification, or education in systems, networking, and packet analysis.
• Participate in intelligence collaboration forums to obtain and share threat indicators.
• Handle and report critical and high-severity incidents.

Skills on Resume: 

• Log Correlation (Hard Skills)
• Malware Analysis (Hard Skills)
• Anomaly Detection (Hard Skills)
• Network Protocols (Hard Skills)
• Threat Analysis (Hard Skills)
• Intelligence Reporting (Hard Skills)
• Data Interpretation (Hard Skills)
• Incident Handling (Hard Skills)

Job Summary: 

• Lead investigations, engage with different stakeholders, communicate investigations to leadership, and drive incident resolution.
• Respond to new incidents as part of a distributed daytime operations and on-call schedule.
• Handle SEV-1s independently and SEV-0s with some support.
• Guide investigations with multiple teams across multiple organizations to gain traction and balance tradeoffs to resolve issues.
• Handle incomplete incident context and choose the best solutions with limited or incomplete information.
• Partner and build relationships with the Engineering and Security teams to contain and mitigate risks during incidents.
• Lead blameless incident postmortems and identify root causes, including systemic issues.
• Identify, secure commitment for, and follow up on projects identified in the postmortem process.

Skills on Resume: 

• Incident Investigation (Hard Skills)
• Stakeholder Engagement (Soft Skills)
• Incident Response (Hard Skills)
• Cross-Team Collaboration (Soft Skills)
• Problem Solving (Soft Skills)
• Risk Mitigation (Hard Skills)
• Root Cause Analysis (Hard Skills)
• Postmortem Leadership (Soft Skills)

Job Summary: 

• Support 24x7x365 CIRT Operations providing Incident Response (IR) services across all phases of the IR lifecycle.
• Perform comprehensive network monitoring.
• Aggregate, correlate, and analyze related events and associated data to determine the magnitude of suspected or confirmed incidents.
• Coordinate and manage IR cases and response activities throughout the IR lifecycle.
• Research and maintain proficiency in system exploitation TTPs, and current emerging threat sources and attack vectors.
• Perform forensic analysis on system components, digital media, and network traffic captures against recognized attacker TTPs and indicators of compromise (IOCs) to investigate suspected incidents.
• Develop and update Incident Response TTPs, SOPs, and playbooks.
• Develop, tune, and maintain employed SIEM tools, scripts, IOCs, and supporting infrastructure to increase detection accuracy and improve network monitoring capabilities.
• Document investigation and Incident Response actions, and prepare Incident Reports.
• Create metrics and dashboards to monitor IR program effectiveness and determine Key Performance Indicators to drive the maturity of SOC operations.

Skills on Resume: 

• Incident Response (Hard Skills)
• Network Monitoring (Hard Skills)
• Event Correlation (Hard Skills)
• Case Management (Hard Skills)
• Threat Research (Hard Skills)
• Forensic Analysis (Hard Skills)
• Playbook Development (Hard Skills)
• SIEM Management (Hard Skills)

Job Summary: 

• Use a variety of tools and resources to perform system and network analysis of suspected or potential security incidents.
• Document all steps and techniques used during analysis in an incident database.
• Report found indicators of compromise to allow for internal defensive measures to be developed.
• Develop and maintain necessary procedures or scripts to identify cybersecurity incidents.
• Keep up to date with cybersecurity trends and capabilities.
• Work and interact with other DCO professionals, internal and external to Army Cyber Command, law enforcement, including Counter Intelligence (CI) LNOs, and intelligence professionals as a technical specialist to understand higher-level adversary capabilities.
• Assist the team in updating and maintaining standard operating procedures.
• Work with a wide range of network/system detection, prevention, and analysis tools.

Skills on Resume: 

• System Analysis (Hard Skills)
• Network Analysis (Hard Skills)
• Incident Documentation (Hard Skills)
• IOC Reporting (Hard Skills)
• Script Development (Hard Skills)
• Cybersecurity Awareness (Soft Skills)
• Team Collaboration (Soft Skills)
• Tool Utilization (Hard Skills)

Job Summary: 

• Provide subject matter expertise on incident response, forensic, and malware analysis.
• Develop, document, and implement runbooks, capabilities, and techniques for incident response.
• Perform triage and analysis on workstations, servers, and network infrastructure.
• Identify and analyze malware using live forensics, hard drive forensics, sandboxes, and reverse engineering.
• Identify indicators of compromise and apply them to the incident response process.
• Perform activities necessary for immediate containment and short-term resolution of incidents.
• Maintain current knowledge and understanding of the threat landscape, emerging security threats, and vulnerabilities.
• Coordinate and drive efforts during response activities and post-mortem.
• Participate in after-hours on-call rotation.
• Determine the root cause of complex information security incidents.

Skills on Resume: 

• Incident Response (Hard Skills)
• Forensic Analysis (Hard Skills)
• Malware Analysis (Hard Skills)
• Runbook Development (Hard Skills)
• IOC Analysis (Hard Skills)
• Incident Containment (Hard Skills)
• Threat Awareness (Soft Skills)
• Root Cause Analysis (Hard Skills)

Job Summary: 

• Respond and enhance the Incident Response Plan based on emerging threats, collected data, and identified triggers.
• Contribute to the Cyber Threat Intelligence program.
• Participate in SOC tooling improvements and process optimization.
• Promote IT security awareness across both technical and business teams while considering operational and day-to-day constraints.
• Strengthen overall security posture by innovating and implementing industry best practices.
• Collaborate with all employees to ensure adherence to security measures, fostering communication and curiosity as essential factors for a stable and efficient SOC.
• Set objectives, report on activities, and define measurable steps to achieve goals.
• Research evolving threats and advancements in technologies designed to prevent unauthorized access to information.
• Assist the team in publishing incidents, alerts, advisories, and bulletins.

Skills on Resume: 

• Incident Response Planning (Hard Skills)
• Threat Intelligence (Hard Skills)
• Tooling Optimization (Hard Skills)
• Security Awareness (Soft Skills)
• Best Practices Implementation (Hard Skills)
• Collaboration (Soft Skills)
• Goal Setting (Soft Skills)
• Threat Research (Hard Skills)

Job Summary: 

• Monitor real-time operation of the Call Management System to ensure Service Level Agreements (SLAs) are being met and all available Customer Service Engineers (CSEs) are actively assigned to calls, continuously monitoring "white space" on the Call Management System to ensure maximum productivity of CSEs.
• Mark CSE unavailability on the Call Management System chart for emergency situations as per standardized documentation, and make the Business Team aware of those occurrences.
• Review call lists, determine initial urgency, and schedule appropriately through interface with CSEs, Business Team, and customers.
• Utilize team and geography knowledge to provide feedback to the Business Team to improve resource efficiencies.
• Participate in conference calls.
• Escalate urgent service needs and CSE-related issues and concerns to the appropriate management team.
• Assist in training new Call Management Coordinators in using the Call Management System.
• Document customer dissatisfaction and field issues and provide them to the Business Team for appropriate action.
• Document customer satisfaction and recognition of CSEs for good performance.
• Contact customers with estimated times of arrival.

Skills on Resume: 

• Call Management (Hard Skills)
• SLA Monitoring (Hard Skills)
• Scheduling (Hard Skills)
• Resource Optimization (Hard Skills)
• Communication (Soft Skills)
• Issue Escalation (Soft Skills)
• Training Support (Soft Skills)
• Customer Relations (Soft Skills)

Job Summary: 

• Combat computer security incidents through all phases of detection, investigation, and resolution of cybersecurity incidents flagged by various detection systems.
• Identify different types of cybersecurity threats, attack vectors, threat actors, and their motives, along with indicators of compromise, to assist in the development of detection methodology.
• Utilize cutting-edge technology to conduct large-scale investigations and examine host and network-based sources of evidence.
• Use SIEM to analyze EDR, OS, and firewall logs, Full Packet Capture (PCAP), SIEM alerts, Anti-malware alerts, host Intrusion Prevention/Detection System (HIP/DS), and server and application logs to investigate events and incidents for anomalous activity and produce reports of findings.
• Respond to cyber incidents by gathering data and artifacts relevant to the incident and triaging these artifacts to develop containment measures.
• Recommend and document specific countermeasures and mitigating controls.
• Develop comprehensive and accurate reports and presentations for both technical and executive audiences.
• Work with various internal and external security stakeholders to ensure customer security posture is continually strengthened through improved configurations, practices, and processes.
• Become a subject matter expert on the customer’s network and security posture.
• Proactively look for security trends and make recommendations within a customer’s environment.
• Provide feedback to grow incident response capabilities from a technical and analytical skills perspective.
• Participate in an on-call rotation with the Incident Handling team to ensure customers are fully supported.

Skills on Resume: 

• Incident Management (Hard Skills)
• Threat Identification (Hard Skills)
• Digital Forensics (Hard Skills)
• Log Analysis (Hard Skills)
• Containment Measures (Hard Skills)
• Mitigation Controls (Hard Skills)
• Technical Reporting (Hard Skills)
• Stakeholder Collaboration (Soft Skills)

Job Summary: 

• Act as Incident Commander for high-impact cyber breaches and advanced attacks following Cyber Kill Chain methodology and the incident response process.
• Understand incident response processes and participate in analysis, containment, and eradication of cybersecurity events and incidents.
• Conduct malware analysis and identify Indicators of Compromise (IOCs) to evaluate incident scope and associated impact.
• Utilize analytic experience to address cyber-attacks and mitigate indicators and correlations to identify attribution and potential threat and impact to Verizon.
• Enhance workflow and processes, driving incident response and mitigation efforts.
• Execute the Incident Response Lifecycle to drive threat remediation and identify strategic countermeasures, improving future defenses.
• Leverage forensics techniques, tools, and capabilities to support cyber incident response activities.
• Perform analysis of logs from various security controls, including firewall, proxy, host intrusion prevention systems, endpoint security, and application and system logs, to identify possible threats to network security.
• Enrich data using multiple sources.
• Handle and mitigate cybersecurity incidents rapidly.
• Provide leadership and guidance to advance the defensive capabilities of the Threat Management Center (TMC) and its ability to defend the Verizon Enterprise.
• Write technical articles for knowledge sharing.
• Collaborate with Threat Monitoring event handlers to improve prevention and detection methods.

Skills on Resume: 

• Incident Command (Hard Skills)
• Incident Response (Hard Skills)
• Malware Analysis (Hard Skills)
• Threat Attribution (Hard Skills)
• Process Improvement (Soft Skills)
• Forensic Techniques (Hard Skills)
• Log Analysis (Hard Skills)
• Team Leadership (Soft Skills)

Job Summary: 

• Detect, classify, process, track, and report on cybersecurity events and incidents.
• Coordinate and collaborate with internal teams to analyze and respond to events and incidents.
• Perform triage and response capabilities 24x7x365.
• Monitor and triage the CIRT hotline, email inboxes, and fax.
• Create tickets and initiate workflows as instructed in SOPs.
• Collaborate with other local, national, and international CIRTs.
• Support daily monitoring, threat assessment, mitigation, and reporting activities to safeguard agency information assets.
• Lead incident response functions and report findings back to customers and affected stakeholders.
• Create and maintain forensic and incident management policies that govern the handling of incidents.
• Facilitate tabletop exercises with the CIRT and customers.

Skills on Resume: 

• Event Detection (Hard Skills)
• Incident Tracking (Hard Skills)
• Incident Triage (Hard Skills)
• Workflow Management (Hard Skills)
• Team Collaboration (Soft Skills)
• Threat Mitigation (Hard Skills)
• Policy Development (Hard Skills)
• Tabletop Facilitation (Soft Skills)

Job Summary: 

• Act as the main investigator for potential incidents identified by cyber analysts.
• Handle incidents through their lifecycle and work with DOC users to analyze, triage, contain, and remediate security incidents.
• Communicate guidance to end users, DOC Bureaus, and senior officials.
• Prepare situational awareness reports for DOC, Bureaus, and/or DOC management.
• Identify process improvements and generate ideas to improve the ESOC’s capabilities.
• Disseminate information to the appropriate stakeholders on time.
• Create and maintain an outstanding partnership with customers.
• Use communication tailored to customers’ level of expertise to help them understand the full scope of information available, ask the right questions, and advance the maturity of their security program.
• Action customer requests promptly, including directing and coordinating efforts with other teams.
• Author and research resiliency documentation to be published in the SaaS App.
• Work closely with the development team to turn resiliency documentation into an automatically detected data point.
• Write Python detection rules for queried API data.
• Proactively implement security measures based on resiliency research.

Skills on Resume: 

• Incident Investigation (Hard Skills)
• Incident Lifecycle Management (Hard Skills)
• User Communication (Soft Skills)
• Situational Reporting (Hard Skills)
• Process Improvement (Soft Skills)
• Stakeholder Dissemination (Soft Skills)
• Customer Partnership (Soft Skills)
• Python Scripting (Hard Skills)