CSOC Lead Analyst

**Position is Contingent Upon Award**

Peraton seeks innovative professionals who thrive in mission-critical environments and are passionate about protecting our national critical infrastructure. This is your chance to make an impact on one of the nation’s vital organizations, working alongside leaders in cybersecurity engineering, operations, forensics, threat analysis, data science, and systems integration.

Join Peraton in supporting a large critical infrastructure operator to defend its corporate and operations networks from nation-state attacks, ensure the confidentiality, integrity, and availability of its systems and operations infrastructure, and comply with federal and industry cybersecurity regulation. As a lead analyst in a 24x7x365 Cybersecurity Operations Center (CSOC), the position provides leadership of CSOC shift staff to monitor the company’s networks and systems using Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR) and Security Orchestration, Automation, and Response (SOAR) systems such as Splunk, CrowdStrike, Nessus Security Center, Axonius, Swimlane, Websense, NetFlow and other tools to identify and investigate anomalies and thwart cyberattacks. Duties include analyzing security alerts, leading investigations, assessing threats, and implementing procedures to respond to incidents as a senior member of the company’s CSOC.

Primary Responsibilities:

The CSOC Lead Analyst will be responsible to:

• Lead a CSOC shift to monitor security reporting systems, dashboards and indicators of suspicious activity and unauthorized access for an extensive critical infrastructure covering 8 states
• Validate SIEM/EDR/SOAR security alerts, open case management investigations and direct analyst staff investigations
• Review open case management reports, progress investigations, assess potential risks and determine issue priority and escalation path
• Review threat and vulnerability advisories issued by various government organizations
• Conduct research to determine the applicability of advisories to the operator environment
• Interact with internal Subject Matter Experts and functional groups to request information, discuss events, escalate issues and coordinate a response
• Formulate mitigation recommendations and document investigations
• Prepare shift reports and brief CSOC Manager, infrastructure stakeholders and corporate management on active investigations
• Conduct open source research and stay abreast of the latest cyber threats and security tools

Additional Responsibilities:

• Perform network and systems analysis of intrusion alerts to the network infrastructure and anomalous traffic, applications, operating systems, firewalls, proxy devices and malware detection, security incidents or anomalies flagged by monitoring tools, triage, and escalate them as warranted
• Perform in-depth security analysis of alerts from firewalls and reviewing system logs for suspicious patterns, perform preliminary incident response, event analysis and threat intelligence
• Investigate threats across multiple data systems and create incident review cases on notable events
• Investigate flagged alerts, determine if they are real threats, and follow designated response and containment procedures
• Confirm continuous data flows from system logs, PCAP captures, and intelligence feeds into the SIEM systems
• Review flagged events that are detrimental to the company’s overall security posture; analyze and detect sophisticated and nuanced attacks, discern false positives and draft reports of results for management
• Correlate network and system sensor events
• Conduct advanced forensic event investigation of logs and network protocol traffic and identify anomaly and potential threats
• Provide near real-time and short-term correlation of data collected by the SIEM/EDR tools and investigate threats across data types over specific study time frames or systems
• Provide strategic analysis and near real-time auditing, investigating, reporting, and coordinating tracking of security-related flagged incidents
• Analyze intelligence feeds from systems, other analysts, and outside agencies, and integrate learnings into protection devices
• Recommend changes to security assets such as firewalls, VPNs, to remediate issues or improve defensive posture to CSOC and security management
• Review and process cybersecurity alerts and threat intelligence feeds and notifications provided by external government agencies and cybersecurity organizations, evaluate and recommend internal distribution as warranted
• Assist with CSOC daily tasks and operations such as CSOC communications, completeness and fidelity of CSOC reports, and status of incident cases as directed by management
• Recommend new and improved SIEM/EDR threat indicators

Required:

• U.S. Citizenship Required
• Must have the ability to obtain / maintain a DOE L Level or DOE Secret clearance
• Degree in computer science, engineering, cybersecurity, information technology, or related field
• Minimum of 8 years experience with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD
• Cybersecurity experience in roles such as security monitoring, threat and risk assessment, incident response, forensic analysis, offensive testing, controls assessment, vulnerability research or CSOC operations
• Understanding of industry cybersecurity standards such as FISMA, NIST 800 series, and regulatory compliance requirements
• Demonstrated strategic thinking, CSOC operations leadership, or broad understanding of risk management
• Strong analytical and problem-solving skills to investigate and assess security risks
• Excellent verbal and written communications skills
• Ability to communicate technical issues to both infrastructure owners and management
• Must be able to work on a 4-month 24x7x365 shift rotation schedule

Desired:

• Hold cybersecurity certification such as CISSP, CISM, SSCP, GIAC GSEC, OSCP, CEH, CISA SSCP, GIAC GCIH (GCIH), EC-Council CSA
• A master’s degree in computer science, engineering, cybersecurity, information technology, or related field

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.