Common Job Duties:

• System or network administration with a focus on security operations
• Investigate, analyze, and respond to cyber incidents within the network environment or enclave
• Receive and analyze network reports/alerts from various sources within the enterprise and determine possible causes of such alerts
• Deep system and event log analysis of computers, anti-virus events, firewall connections, local network administration services (SMB, DNS, FTP, SSH), vulnerability scan results, identity access, authentication and authorization technology, email and web access and services (HTTP, POP3), intrusion detection/prevention systems, and security incident and event management (SIEM)
• Intrusion artifact collection and discovery (source code, malware)
• Digital forensics and malware analysis
• Correlate incident data to identify specific vulnerabilities and make recommendations that enable expeditious remediation
• Expert technical support to enterprise-wide cyber defense technicians to resolve cyber defense incidents
• Technical expert and liaison to law enforcement and executive personnel and explain incident details as required
• Coordinate incident response functions
• Write and publish cyber defense techniques, guidance, incident findings, and after-action reviews to constituents
• Perform cyber defense trend analysis and reporting
• Collaborate with colleagues to evaluate security mechanisms and processes that enhance response capabilities